Password Strength Checker

Most strength meters only count character types, so they call “P@ssw0rd!” strong because it has a capital, a number and a symbol. Real attackers don’t guess that way. They start with lists of leaked passwords, dictionary words and names, then try the tricks people use: a capital at the front, a year or “!” on the end, 0 for o, keyboard runs like qwerty and 1qaz2wsx. This checker thinks the same way.

As you type, it breaks the password into the pieces an attacker would recognise, such as a common password, a word, a name, a date, a sequence, a repeat or a keyboard walk, and works out the cheapest way to guess the whole thing. That estimate becomes an average crack time for four realistic attacks, from a website that limits login attempts to a stolen database being hammered by graphics cards. You also get the specific weaknesses in plain English and concrete ways to fix them.

The check runs entirely in your browser. The password is never stored, logged or sent, and the page makes no network request while you type. There is deliberately no “has it been leaked?” lookup, because that would mean sending something about your password over the internet.

1. Type or paste a password into “Password to check”. It stays hidden as dots unless you press Show.
2. Read the meter: Very weak, Weak, Fair, Strong or Very strong, with the estimated number of guesses.
3. Look at “How long to crack it” for the four attack speeds, especially the online and fast offline ones.
4. Check “What an attacker would see” for the pieces found and the weaknesses behind the score.
5. Follow “How to make it stronger”, or open the Password Generator for a random one.

• Pattern-aware estimate built from scratch: common passwords, dictionary words, names, misspellings, look-alike swaps, reversed words and capitals.
• Spots keyboard walks (qwerty, zxcvb, 1qaz2wsx), number-pad runs, sequences (abcd, 9876), repeats (aaaa, abcabc), years and dates.
• Average crack time for four attacks: online with login limits, online without, offline with a slow hash, offline with a fast hash.
• Colour-coded breakdown of every piece the attacker would recognise, masked while the password is hidden.
• Specific weaknesses and suggestions in plain English, not just a score.
• Show / Hide toggle, character-mix tags and length count; the first 64 characters are analysed.
• No network access while checking, and no breach lookup by design.

• The estimate is an informed guess, not a promise. It can’t know if the password is linked to you, such as your street, team or child’s name, which makes it weaker than shown.
• A password that is strong but reused is still at risk: one leaky website exposes it everywhere you used it.
• Online attacks are slow because websites limit attempts. The offline numbers matter when a site’s database is stolen, which is why length counts.
• Avoid checking your real, current passwords on any site you don’t trust. Here it is safe because nothing leaves your device, but the habit matters.