Password strength checker
Type or paste a password. The meter moves from very weak to very strong, and the boxes show how long a guess might take online and offline. Add names or words that belong to you so those are treated as easy guesses.
- Score and crack time
- Free, no sign-up
Runs in your browser. Nothing you type or open is uploaded. Free to use, no account. More everyday tools
How to use it
- Type or paste the password in the password box.
- Add names or words that a guesser might know, separated by commas.
- Read the score, the times and the suggestions.
What the score is based on
The estimate uses common passwords, names, dictionary words, keyboard walks, repeats and substitutions such as a zero standing in for the letter o. A short word scores as weak even with a capital and a number on the end. A long password built outside those patterns scores as strong.
Four times are shown: an online guess with a rate limit, an online guess with no rate limit, an offline attack against a slow hash, and an offline attack against a fast hash. The suggestions name a change that would raise the score. Show password reveals the box while you check it, and Hide password covers it again.
Private by design
Privacy
The password stays in this tab. It is left out of the page address and out of the settings this device remembers. Closing the tab clears it.
This page also shows Google ads, which can use cookies. Privacy and cookies explains how.
Questions
Is the password sent anywhere?
The check runs in this tab. The password is left out of the page address and left out of the settings this device remembers.
Why does a familiar word score as weak?
Common words, names and patterns are the first things a guesser tries. Adding a symbol to the end of a word changes the score very little.
What should I type in the names box?
Your name, a pet, the site, or any word that belongs to this password. Those are then treated as easy guesses.
What is a slow hash?
A password store that deliberately takes time, such as bcrypt or scrypt. A fast hash is the other case, where a guesser can try billions of passwords a second.
Does a high score mean a site will accept it?
The score describes how hard a guess is. A site may still require a symbol or refuse a password it has seen in a breach.