Password Strength Checker
Find out how quickly a password you made up could be guessed, what makes it weak, and how to improve it.
Runs in your browser. Your data is not uploaded.How our tools work
Checked on your device. The password isn’t sent, saved or logged anywhere.
Type a password to see how quickly it could be guessed. Don’t paste a password you use for an important account on any website you don’t trust.
How do I check if my password is strong?
Type a password to see how quickly it could be guessed, rated from Very weak to Very strong. It is checked against common passwords, keyboard patterns, repeats, sequences and dates, not just its character types, so “Password1!” rates weak. You also get specific tips on what makes it easy to guess.
- Type or paste the password. Select Show to see what you typed.
- Read the rating, the warning and the suggestions.
- If it’s weak, make it longer or use a passphrase of several random words, or create one with the Password Generator.
Key features
Realistic estimate
Uses zxcvbn-ts, an open-source estimator that models how attackers guess: common passwords, keyboard rows, repeats, sequences, dates and swaps like @ for a.
Five ratings
Very weak, Weak, Fair, Strong and Very strong, based on the estimated number of guesses, with a meter and a text label.
Specific advice
Says what makes the password easy to guess and how to improve it.
Common uses
- Check a new password before you use it
- See why a password that meets the rules is still weak
- Learn what makes passwords hard to guess
Why length beats symbols
Rules like “one capital, one number, one symbol” lead to predictable passwords such as Password1!, which attackers try early. Each extra random character or word multiplies the number of guesses needed, so a passphrase of four or more random words is usually stronger and easier to remember.
The times shown are rough estimates for an attacker who knows these patterns. They depend on how a site stores passwords, and no checker can guarantee a password won’t be guessed or hasn’t already leaked.
Frequently Asked Questions
Is it safe to type my password here?
The check runs entirely in your browser: the password isn’t sent to any server, saved or logged. Even so, it’s good practice not to type passwords for important accounts into sites you don’t trust; you can test a similar password instead.
Why is my password weak even though it has symbols?
Because attackers try common words, names, years and substitutions such as @ for a first. A password like P@ssw0rd2024! looks complex but follows a pattern that is guessed quickly.
Does it check if my password was in a data breach?
No. That would mean sending information about it over the internet. The checker does recognise many common passwords that appear in breach lists.
How long should a password be?
At least 15 characters when the password is the only thing protecting an account, the minimum in NIST’s current guidelines, or a passphrase of four or more random words. Use a different password for every account.
Sources
Last updated: