Realistic Estimation
We use the zxcvbn library developed by Dropbox, which analyzes real-world attack patterns, dictionary words, and common substitutions — not just character counts. We also flag an instant, exact match against the 10,000 most commonly breached passwords, entirely offline.
100% Private
Strength analysis happens entirely in your browser — your password is never transmitted, stored, or logged. The optional breach check sends only a partial hash, never your actual password.
Instant Analysis
Real-time strength feedback as you type. Covers offline dictionary attacks, brute-force scenarios, and pattern recognition simultaneously.
Why character-counting gets this wrong
Traditional strength meters count uppercase letters, digits, and symbols and reward you for adding a "!" or capitalizing a letter — which is how P@ssw0rd! scores as "strong" on so many sites despite being one of the first passwords any real attacker tries. This checker uses zxcvbn instead, which models how attacks actually work: dictionary words, names, keyboard walks, and leet-speak substitutions are matched as patterns first, and only the unpredictable part left over gets counted toward your entropy.
That's also why length matters more than character variety. Per NIST SP 800-63B-4 (see Sources below), 15+ characters from a large, non-obvious pool beats 8 characters with a "required" symbol and digit — the crack-time estimates above are shown across four realistic attack scenarios, from a throttled online login to an offline fast hash, rather than one generic number, because the honest answer to "how long would this take to crack" always depends on how the password is stored on the other end.
Where this tool's guidance comes from
This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source.