Password Strength Checker — zxcvbn Powered
zxcvbn goes beyond naive length/character rules — it checks against dictionaries, common patterns, and keyboard walks to estimate realistic crack times. Your password is never transmitted or logged.
Last updated: · Runs 100% in your browser
// What is the Password Strength Checker?
The Password Strength Checker estimates how long a realistic attacker would need to guess a password, rather than counting whether you used an uppercase letter. It uses pattern-based analysis that recognises dictionary words, names, keyboard walks, dates, repeats and the predictable substitutions people apply to them — so P@ssw0rd1 is correctly rated as weak despite ticking every conventional complexity box. You get a score, an estimated crack time under several attack scenarios, and specific feedback on which pattern is undermining the password. Analysis runs entirely in your browser using a local dictionary; the password is never transmitted, hashed remotely or compared against any online service.
// Features
- ▸0–4 strength score with visualisation
- ▸Estimated online and offline crack times
- ▸Actionable improvement suggestions
- ▸Fully local — password is never sent
// How to use
- 01Type or paste a candidate password.
- 02Read the score and estimated crack time.
- 03Follow the suggestions to strengthen it.
// Use cases
- ▸Sanity-checking a password you invented before committing to it.
- ▸Demonstrating to a team why complexity rules are weaker than length.
- ▸Auditing the strength policy of an application you are building.
- ▸Explaining to a non-technical colleague why their password is guessable.
// FAQ
Your data never leaves your browser. This tool runs 100% locally — no upload, no logging, no analytics on your inputs.