Password Strength Checker
Find out how long a password would really survive an attack — and whether it has already leaked.
- Leak check sends 5 characters of a hash — never your password
- 100% free
- No sign-up
How to check password strength
- Type a password.
- Read the strength, crack times and the patterns found.
- Optionally check data breaches, then improve it.
About Password Strength
Check how strong a password really is.
It works in your browser for speed and privacy, remembers your settings on this device, and every result can be copied, downloaded or shared.
Good for
- Checking passwords before you use them
- Security awareness training
- Choosing a master password
Tip: Do not test your real banking password on any website — test a similar pattern instead.
Frequently asked questions
Is it safe to type my password here?
Yes — the analysis runs in your browser and the password is never sent or saved. The optional breach check sends only the first 5 characters of its SHA-1 hash (k-anonymity), never the password.
Why is “P@ssw0rd2024!” weak?
Because cracking tools try dictionary words with common swaps (@ for a, 0 for o), years and a closing “!” first. The checker counts those patterns as the few guesses they really are.
How is crack time estimated?
From the estimated entropy for four attacks: rate-limited online guessing, unlimited online guessing, a stolen database hashed with bcrypt, and one with a fast hash cracked on GPUs.
What makes a strong password?
Length and randomness: 16+ random characters, or 4–6 random words. Use a different one for every site and keep them in a password manager.
How long should a password be?
At least 12 characters for everyday accounts and 16 or more for important ones. A passphrase of four or more random words is long and still easy to remember.