Contact

Tools  /  Security  /  Password Strength Checker

SECURITY

Password Strength Checker

Pattern-aware strength analysis -- common passwords, sequences, keyboard walks, repeats and dates detected, not just raw entropy -- plus multi-scenario crack times and an optional breach check.

More Security tools

SHA-512 Hash Generator JWT Structure Viewer JWT Expiration Checker JWT Claims Viewer Checksum Calculator SHA File Checker

What this tool does

Analyzes a password the way an actual attacker would, not just by counting characters. A raw entropy estimate (length × log2(character pool size)) assumes every character was drawn uniformly at random — but Password1! and a truly random 10-character string use the same character pool and length, while being wildly different in how fast each would actually be guessed. This tool detects the patterns that make the first one weak — being a known common password, a keyboard walk, a sequential run, a repeated run, a date, or a common word with simple substitutions — and shows a penalty-adjusted strength score alongside the raw one, plus crack-time estimates across four realistic attack scenarios, not one generic number.

What gets detected, and why each one matters

  • Known common/breached passwords — checked against a list of the most common passwords found in real breach dumps. A match means instant compromise via a dictionary attack, regardless of length or "complexity".
  • Leetspeak substitutions — p4ssw0rd is password with predictable character swaps (4→a, 0→o, 3→e...) that cracking tools check for automatically; it offers almost no more protection than the plain word.
  • Sequential runs — abcd, 3456, wxyz — adjacent characters in alphabet or digit order contribute far less real entropy than their length suggests, since they're among the first patterns any cracking tool tries.
  • Keyboard walks — qwerty, asdfgh, zxcvbn — physically adjacent keys, another extremely common and extremely weak pattern.
  • Repeated runs — aaa, 1111 — repetition collapses what looks like several characters of entropy into effectively one decision.
  • Dates — a 19xx/20xx-shaped year is commonly guessed (birth years, current year) and checked early by targeted attacks.

Crack time across four real scenarios

A single crack-time number is almost always misleading, because it depends entirely on how the password is being attacked. This tool shows four: online, rate-limited (~100 guesses/hour — a login form with lockout), online, unthrottled (~10/second — a login form with no rate limiting), offline, slow hash (~10,000/second — a leaked database hashed with bcrypt/Argon2, the way passwords should be stored), and offline, fast hash (~10 billion/second — a leaked database hashed with raw MD5/SHA-1, the way passwords unfortunately sometimes are). The same password can be "centuries" in the first scenario and "seconds" in the last.

NIST SP 800-63B, in short

Current NIST guidance (the US federal digital identity standard) explicitly recommends: prioritize length over forced complexity rules (requiring 1 uppercase + 1 digit + 1 symbol tends to produce predictable patterns like Password1!, not stronger passwords); check new passwords against a list of known-breached ones (what this tool's pattern detector and optional HaveIBeenPwned check both do); and stop forcing periodic password changes with no evidence of compromise, since that historically just pushed people toward weaker, more predictable passwords.

The optional breach check — the one thing that isn't fully local

Every other tool on this site, and everything else on this page, runs entirely in your browser. The one exception, entirely opt-in and never automatic, is the HaveIBeenPwned breach check button: it computes a SHA-1 hash of your password locally, sends only the first 5 characters of that hash to the HaveIBeenPwned Pwned Passwords API (k-anonymity — this is the same privacy-preserving technique used by 1Password, Firefox Monitor and other password managers), gets back every known breached password hash sharing that prefix, and checks locally whether your full hash is among them. Your actual password is never transmitted, and neither is your full hash — only an ambiguous 5-character prefix shared by roughly a thousand other hashes.

Why there's no password history here

Unlike the Password Generator (which creates fresh, throwaway candidates), this tool is meant for checking a password you might actually use — so, deliberately, nothing you type here is kept anywhere, not even in this tab's memory, not even temporarily.

FAQ

Frequently asked questions

Is my password uploaded anywhere?
No, with one clearly marked exception: if you click the optional "Check against known breaches" button, a SHA-1 hash of the password is computed locally and only its first 5 characters are sent to the HaveIBeenPwned API (k-anonymity) -- your actual password and full hash never leave your browser. Nothing else on this page makes any network request, and nothing you type is ever stored, including temporarily.
Why does the "effective" strength differ from the raw entropy number?
Raw entropy assumes every character was drawn uniformly at random, which overestimates passwords with patterns a real attacker would check first -- a known common password, a keyboard walk, a sequential run, a repeated run, a date, or a common word with letter-to-number substitutions. This tool detects those patterns and shows a penalty-adjusted score alongside the raw number.
Why four different crack-time estimates instead of one?
Because the real answer depends entirely on how the password is being attacked -- a rate-limited login form, an unthrottled one, a leaked database hashed with a slow algorithm like bcrypt, or one hashed with a fast algorithm like raw MD5. The same password can be centuries in one scenario and seconds in another; showing only one number hides that.
What is the HaveIBeenPwned breach check, and is it safe to use?
It checks whether your password has appeared in known data breaches, using k-anonymity: only an ambiguous 5-character hash prefix (shared by roughly a thousand other hashes) is sent, never your password or its full hash. This is the same technique major password managers use, and it's the one deliberate exception to this tool's otherwise fully local/offline operation -- entirely opt-in, never automatic.
What does NIST actually recommend for passwords?
Current NIST SP 800-63B guidance prioritizes length over forced complexity rules, recommends checking new passwords against known-breached lists, and advises against forcing periodic password changes without evidence of compromise -- all reflected in what this tool checks and shows.
Why isn't there a history of passwords I've checked?
Deliberately -- unlike a generator producing fresh throwaway candidates, this tool is for checking a password you might actually use, so nothing you type here is ever kept, not even in this tab's memory.
Theme Accent