Password Strength Checker

A password’s real strength is not its length alone — it is how many guesses an attacker would need. This checker estimates that the way the zxcvbn method does: it looks for common passwords, dictionary words, look-alike symbol swaps, keyboard runs, sequences, repeats, years and dates, finds the cheapest way to build your password from those pieces, and reports a 0–4 score, the guess count and crack times at four attack speeds. A second mode estimates strength from a length and character set.

How to use this tool

1. Type a password to analyse it, or switch to the length-and-character-set mode.
2. Read the score and the breakdown of the pieces it found.
3. Check the crack-time table for the attack speed that matters to you.
4. Follow the advice to make it stronger.

Formula

For a truly random password, entropy = length × log₂(pool size), and guesses ≈ 2^entropy. In Check mode the tool splits the password into pieces, gives each a guess count (a list rank, a pattern count, or pool size ^ length for random characters) and takes the cheapest split: guesses = l! × the product of the pieces’ guesses, where l is the number of pieces.

Crack time = guesses ÷ 2 ÷ attempts per second, because on average an attacker succeeds after trying half the possibilities. Scores: under 10³ guesses is 0, under 10⁶ is 1, under 10⁸ is 2, under 10¹⁰ is 3, and 10¹⁰ or more is 4.

Example

"password1234" looks long, but it splits into the most common password plus "1234": 2! × 50 × 50 = 5,000 guesses, a score of 1 that a fast offline attack clears instantly. A random 12-character password using all 94 printable symbols has 12 × log₂(94) ≈ 78.7 bits instead.