Password Strength Checker

With zxcvbn, which estimates how many guesses an attacker would need. It looks for what attackers try first: common passwords, names, dictionary words, keyboard patterns like “qwerty”, dates, repeats and l33t substitutions. “P@ssw0rd!” has symbols and numbers but is still guessed quickly.

They are estimates for different attacks. Online means guessing through a website’s login, which usually limits attempts. Offline means an attacker has a stolen copy of a password database: a slow hash (bcrypt, Argon2) allows thousands of guesses a second, a fast or unsalted hash billions.

No. That would mean sending something about it to another service, and this page sends nothing. The check uses a list of common passwords built into the page.

Length and unpredictability. Four or more random words (“correct horse battery staple”) or a password manager’s random 16-character password beat a short one full of symbols. Use a different password for every account.

It is free to use and there is nothing to sign up for. There are no watermarks and no daily limits.