Password Strength Checker
🚨 This is one of the 10,000 most commonly used passwords. It will be one of the very first guesses in any real attack, no matter how long it is.
Interactive Analysis
VERY WEAK
seconds–minutes
WEAK
hours–weeks
GOOD
months–years
STRONG
centuries
Estimated Time to Crack
—
offline slow-hashing (bcrypt/scrypt)
Strength Class
—
offline slow-hashing (bcrypt/scrypt)
Uppercase (A–Z)
Lowercase (a–z)
Numbers (0–9)
Special (!@#$…)
8+ characters
16+ characters
💡 Tips to Improve
🛡️ Data Breach Check Have I Been Pwned
Optional & privacy-preserving: only the first 5 characters of your password's SHA-1 hash are sent (k-anonymity) — your full password never leaves your device. How this works →
Detailed Analysis
Overall Strength
🔐
Enter a password to analyze
We'll show detailed analysis of your password strength and security metrics.
Password Generator
Password Type
Password Length (8–128)
16
Include Characters
Generated Password
Click Generate to create a password
Strength
—
Estimated time to crack: —
🛡️ Data Breach Check Have I Been Pwned
Optional & privacy-preserving: only the first 5 characters of this password's SHA-1 hash are sent (k-anonymity) — the full password never leaves your device. How this works →
Recent Passwords (session only)
No history yet
🔒 Passwords are generated locally in your browser. Nothing is sent to our servers unless you choose to use the optional breach check above, which only ever sends a partial hash — never the password itself.
🧠
Realistic Estimation
We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts. We also flag an instant, exact match against the 10,000 most commonly breached passwords, entirely offline.
🔒
100% Private
Analysis and generation happen entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password.
⚡
Instant Analysis
Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously.