Password Strength Checker
Type a password to see how fast an attacker could guess it. The checker looks for the tricks people use, such as P@ssw0rd-style swaps, years and keyboard rows, and tells you what to fix. Everything runs on your device.
Type a password above to see how strong it really is.
Uses Have I Been Pwned. Only the first 5 characters of your password's SHA-1 hash are sent, never the password.
Zero-Knowledge: checked in your browser. Your password never leaves this device. The optional breach check sends only 5 characters of a hash.
What makes a password strong
- 15 or more characters
- Not a common or leaked password
- No years, dates, keyboard rows, sequences or repeats
- Not found in data breaches (turn on the check above)
Capital letters, numbers and symbols aren't required. Length and unpredictability matter more. That's the rule in NIST SP 800-63B, the US government password guideline.
How the breach check works
The breach check looks your password up in Pwned Passwords, a free list of real passwords leaked in data breaches. It's part of Have I Been Pwned, the service run by security researcher Troy Hunt, and password managers such as 1Password and Bitwarden use the same lookup. If your password is on that list, attackers have it too, and they try leaked passwords first.
What happens when you tick the box
- Your browser turns the password into a SHA-1 hash: a 40-character fingerprint. The same password always gives the same hash, but the hash can't be turned back into the password.
- Only the first 5 characters of that hash go to api.pwnedpasswords.com. The password and the rest of the hash stay on your device.
- The service replies with every leaked hash that starts with those 5 characters, usually around 2,000, plus random padding entries, so even the size of the reply reveals nothing.
- Your browser compares the remaining 35 characters with that list on your device and shows how many times the password was found. The service never learns whether there was a match.
Example with the password "password":
SHA-1("password") = 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
GET https://api.pwnedpasswords.com/range/5BAA6
The reply has about 2,000 hashes. One of them ends in 1E4C9B93F3F0682250B6CF8331B7EE68FD8: "password" has been seen more than 52 million times.
Why it's safe
- Your password never leaves the browser, and neither does its full hash.
- Thousands of passwords share the same first 5 characters, so they don't tell the service which one you typed. This method is called k-anonymity.
- The check is off by default and runs only after you tick the box. Untick it and no more requests are sent.
- The page's security policy (CSP) allows one extra address only: api.pwnedpasswords.com.
You can confirm this yourself. Open your browser's developer tools (F12), go to the Network tab and tick the box: the only new request goes to api.pwnedpasswords.com/range/ followed by 5 characters. To see the SHA-1 of any text, use the Hash Generator.
What "not found" means
"Not found" means the password isn't in any known breach list. It doesn't mean the password is strong: a short or predictable one can still be guessed quickly, so check the score above too. "Found" means stop using it on every account, even if the score looks good.
Sources
Common passwords, tested
Many strength meters only count length and character types. That makes P@ssw0rd2026! look strong. Here is what those meters say, and what this checker finds.
| Password | Simple meters say | This checker |
|---|---|---|
| password | Fair | Very Weak · Instantly |
| Password123! | Strong | Very Weak · 5 seconds |
| qwertyuiop123 | Strong | Very Weak · 2 seconds |
| P@ssw0rd2026! | Strong | Weak · 17 minutes |
| Qwerty!2026 | Strong | Weak · 17 minutes |
| aaaaaaaaaaaaaaaaaaaa | Strong | Very Weak · Instantly |
| xK9#mP2$vL7@nQ4! | Strong | Very Strong · Centuries |
Time to crack assumes a leaked database hashed with bcrypt, about 10,000 guesses per second. With a fast hash like MD5, divide by a million.
Why most strength meters get it wrong
Attackers don't try every combination in order. They start with leaked passwords, dictionary words, names, years and keyboard rows, then add common tweaks like a capital first letter or ! at the end. This checker uses zxcvbn, an open-source estimator built on the same idea, so it scores a password by how quickly those guesses find it.
Pattern detection: Finds common passwords, dictionary words, names, years, keyboard rows, repeats and look-alike swaps such as P@ssw0rd, and shows you each one.
Real crack times: Shows how long a password lasts in 4 situations, from a login page with a rate limit to a leaked database with a fast hash.
Private by design: The check runs in your browser. No password is sent, logged or stored. After the first check you can even turn off Wi-Fi and it keeps working.
Optional breach check: Looks your password up in Have I Been Pwned's list of breached passwords. Only 5 characters of a hash are sent, so the service never learns the password.
Plain advice: Tells you what to change in simple words, following the NIST guideline: length and unpredictability over symbol rules.
How to check your password
Type or paste the password: Use the box at the top. Tap the eye icon to see what you typed.
Read the result: The meter goes from Very weak to Very strong. Below it you see the time to crack and the patterns an attacker would try first.
Check breaches: Tick "Also check known data breaches". If the password was leaked, stop using it everywhere.
Fix it: Follow the tips, or open the Password Generator and save the new password in a password manager.
Frequently Asked Questions
Guides on this topic
How Long to Crack My Password? Real GPU Numbers (2026)
Password crack time on one RTX 4090, by length and charset, against MD5 and bcrypt. The real assumptions behind the table, plus how long yours should be.
Password Entropy Math: Why 12 Characters Is the Floor
Password entropy in bits, how much an attacker can actually exhaust per year, and why 12 random characters is the floor while NIST asks for 15.
How to Create a Strong Password: The 2026 Guide
How to create a strong password: why length beats symbols, what NIST now requires, real RTX 4090 crack times, and when a passphrase is the better choice.