This checker scores passwords from 0 to 4 with zxcvbn-ts, which estimates how many guesses an attacker would need using lists of common passwords, words, names, keyboard patterns and dates; a 4 means about 10 billion guesses or more. The optional breach check is off by default and, when ticked, sends only the first 5 characters of the password's SHA-1 hash to api.pwnedpasswords.com.
What "strength" means here
Rules like "eight characters with a capital, a number and a symbol" say little about how hard a password is to guess. Password1! passes those rules and is one of the first things any attacker tries. A long string of random lowercase words passes none of them and can be very strong.
Attackers do not try every combination in order. They start with what people actually use: leaked passwords, dictionary words, names, dates, keyboard runs like qwerty, and common tweaks such as a capital at the start, @ for a or a year at the end. A useful strength check has to think the same way.
That is what zxcvbn does. It was created at Dropbox and described by Daniel Lowe Wheeler at the USENIX Security Symposium in 2016; this page uses zxcvbn-ts, a maintained TypeScript version. It splits your password into pieces it recognizes, estimates how many guesses each piece would take for an attacker working from those lists, and combines them into an overall estimate.
Check a password
- Click into the box. The first time, the page loads its word lists from this site, which takes a moment.
- Type or paste the password. Tick Show password if you want to see what you typed.
- Read the score from 0 to 4, the estimated number of guesses, and the four crack-time estimates below it.
- Read any warning and suggestions under the score; they name the pattern that made the password weak.
- If you want, tick Check known data breaches to look the password up in the Pwned Passwords list. Leave it unticked to keep everything on your device.
Reading the score
| Score | Label | Estimated guesses | Roughly means |
|---|---|---|---|
| 0 | very weak | under about 1,000 | On every list of common passwords |
| 1 | weak | under about 1 million | Falls quickly even to a slow online attack |
| 2 | fair | under about 100 million | Holds against online guessing, not against a stolen database |
| 3 | strong | under about 10 billion | Reasonable protection if the site stores passwords with a slow hash |
| 4 | very strong | about 10 billion or more | Strong protection under the same assumption |
The crack-time rows turn the guess count into time for four kinds of attacker, using zxcvbn-ts's default speeds:
- Online, with login limits: 100 guesses an hour, like a site that slows down or locks after failed attempts;
- Online, no limits: 10 guesses a second;
- Stolen database, slow hash (bcrypt, scrypt, Argon2 and similar): 10,000 guesses a second;
- Stolen database, fast hash: 10 billion guesses a second, for sites that stored passwords badly.
These are estimates, not promises. Real attackers vary a lot, and the checker cannot know how a password was created. A random password made by a generator may score lower than its true randomness if it happens to contain a word, and a password that is your pet's name plus your street may score higher than it should because the checker does not know your pet or your street.
The breach check: exactly what is sent
The box labeled Check known data breaches is unticked when the page opens. While it is unticked, the password you type never leaves the page.
When you tick it, this is what happens, each time you pause typing for about half a second:
- Your browser computes the SHA-1 hash of the password locally. SHA-1 produces 40 hexadecimal characters.
- The page sends an HTTPS request to
api.pwnedpasswords.com/range/followed by the first 5 of those 40 characters, with a header asking for padded results. The page shows you the five characters it sent. - The service replies with every breached-password hash that begins with those five characters, typically hundreds of them, plus dummy entries added because of the padding header so that every reply is a similar size.
- The page looks for the remaining 35 characters in that reply, here in your browser, and tells you whether and how often the password appears in breaches.
What is not sent: the password itself, and the other 35 characters of its hash. Each five-character prefix is shared by hundreds of breached passwords and by countless passwords that were never breached, so the service cannot tell which one you checked. This method is called k-anonymity.
What the service can see, as with any web request: your IP address and your browser's ordinary request headers. The request carries no cookies and no referrer, so it does not say which page you came from. Because the check runs as you type, intermediate versions of the password are checked too; type or paste the final version before ticking the box if that matters to you.
This page is the only one on the site allowed to connect to another server, and only to that address.
What makes a password stronger
- Length beats complexity. Each random character or word multiplies the work. NIST's 2025 digital identity guidelines (SP 800-63B-4) ask services to require at least 15 characters when a password is the only sign-in factor, to allow at least 64, and to stop imposing composition rules.
- Randomness beats cleverness. Substitutions like
P@55w0rdare in every cracking rule set. A generator picks better than a person; try the password generator or the passphrase generator. - Uniqueness matters most. A strong password reused on two sites is only as safe as the weaker site. A password manager makes unique passwords practical.
- Breached means burned. If the breach check finds a password, stop using it everywhere, whatever its score. NIST's guidelines also ask services to reject passwords found in breach lists.
Your password stays on this page
The strength estimate is computed entirely in your browser, with word lists downloaded from this site. The password is not stored, not logged and not sent anywhere, with the single exception of the five-character hash prefix described above, and only while you have the breach check ticked. Reloading or closing the page clears the box.
Even so, a good habit is to test passwords that are similar to yours rather than the exact one you use for an important account.
Technical note
The estimator is zxcvbn-ts with its common package (leaked-password list, keyboard layouts, the EFF word list) and its English package (common words drawn from the OpenSubtitles corpus, first names, last names and word sequences). The breach lookup uses the Pwned Passwords range API with the Add-Padding header. To watch the requests yourself, open the Network panel as described on the methodology page: with the box unticked you will see no request when you type.
FAQ
Is it safe to type my password into a strength checker?
On this page the check runs in your browser and nothing is sent unless you tick the breach check, which sends only 5 characters of a hash. As a habit, test a similar password rather than the exact one that guards an important account.
What does the breach check send?
The first 5 of the 40 hexadecimal characters of your password's SHA-1 hash, to api.pwnedpasswords.com, and only while the box is ticked. The service returns all breached hashes with that prefix, and your browser does the comparison.
Why is my long password rated weak?
Length only helps when it adds unpredictability. Repeated characters, keyboard runs, common phrases, names and dates are recognized and counted as cheap guesses. The warning under the score names the pattern.
What score should I aim for?
A 4 for anything important, together with a password you use nowhere else. A score of 3 is reasonable for low-value accounts on sites you trust to store passwords properly.
Why does a generated password score lower than I expected?
The checker does not know a password was random. If it contains a dictionary word or a pattern by chance, it counts that piece as easy. Generators report true randomness as entropy; the checker reports guessability.
Does the page remember what I typed?
No. Nothing is saved, and the box is empty again after a reload.
Sources
Checked 2026-10-11.
- Wheeler, "zxcvbn: Low-Budget Password Strength Estimation", USENIX Security 2016
- Have I Been Pwned API v3: Pwned Passwords range search: the 5-character prefix, the returned suffixes and the Add-Padding header (800 to 1,000 results).
- NIST SP 800-63B-4: password length, composition and blocklist guidance (August 2025).
- zxcvbn-ts: the TypeScript implementation and its default attack speeds.
Last updated: