Password Strength Checker
See how long it would take to crack your password, what makes it weak, and whether it has appeared in a data breach. Your password never leaves your device.
Checklist
Has it been leaked?
Check if this password appears in known data breaches (Have I Been Pwned). Only the first 5 characters of its SHA-1 hash are sent — never the password itself.
Your password is checked on your device. It is never sent, saved or logged.
How to Check Your Password's Strength
Three steps to a safer password.
Type Your Password
Enter it in the box. It is checked on your device as you type — nothing is sent.
Read the Result
See the score, crack-time estimates, a checklist and tips on what to improve.
Check for Leaks
Click Check data breaches to see if it has appeared in known leaks (safely, via a partial hash).
Score
0–4 with tips
Shows
Crack-time estimates
Breach check
Have I Been Pwned
Detects
Common words & patterns
Privacy
Runs in your browser
Price
100% free
What the Scores Mean
The checker uses zxcvbn — the same strength estimator used by Dropbox and many other services.
| Score | Label | Means |
|---|---|---|
| 0 | Very weak | Guessed in seconds — a common password or simple pattern |
| 1 | Weak | Guessed quickly online if the site has no lock-out |
| 2 | Fair | OK against online attacks, weak if the site's database leaks |
| 3 | Strong | Good protection for most accounts |
| 4 | Very strong | Very hard to crack even if hashes are stolen |
What Can You Use It For?
Popular ways people use Password Strength Checker.
Check Your Passwords
Find out which of your passwords need changing.
Security Training
Show staff and students why patterns and short passwords fail.
Developers
See what a good strength meter should flag in your own sign-up forms.
Breach Check
Make sure a password hasn't already leaked online.
Tips for the Best Result
- Length beats complexity — Purple-Tiger-Window-42 is stronger than P@ssw0rd!.
- Common substitutions like @ for a or 0 for o don't fool modern cracking tools.
- Never reuse a password that appears in a data breach, even with small changes.
- Need a new one? Make it with our Password Generator.
Frequently Asked Questions
Quick answers about Password Strength Checker.
Yes. The check runs entirely in your browser. Your password is never sent to our server, saved or logged.
Your browser makes a SHA-1 hash of the password and sends only its first 5 characters to Have I Been Pwned. The service returns hundreds of matching hashes and your browser checks the rest locally — so the password itself is never shared.
With zxcvbn, which looks for common passwords, dictionary words, names, keyboard patterns, dates, repeats and l33t-speak — not just length and character types.
They estimate how long an attacker would need: online with or without lock-outs, and offline if a website's password hashes were stolen (slow or fast hashing).
Length (12+ characters), randomness, and being unique to one account. Random words joined together are strong and easy to remember.
Change it everywhere you used it. Attackers try leaked passwords first, no matter how complex they look.
Yes, once the page has loaded. Only the optional breach check needs the internet.
Yes — 100% free, with no sign-up and no limits.
Related Free Tools
Ready to Use Password Strength Checker?
Scroll up and get your result in seconds. 100% free, no sign-up needed.
Start Now