Password Strength Tester

0 characters

— 0.0 bits · 0 guesses (avg)

How long until cracked?

Online · throttled

~100 attempts/hour —

Online · unthrottled

~10 attempts/second —

Offline · slow hash

~10,000/second (bcrypt) —

Offline · fast hash

~10 billion/second (MD5 GPU) —

Detected patterns

Type a password above to begin analysis.

Suggestions

Suggestions appear once you start typing.

Data breach check

Checks the Have I Been Pwned database using k-anonymity: only the first 5 characters of the password's SHA-1 hash are sent — never the password itself.

Need a stronger one? Generate a password →

Your password never leaves this device — all analysis is in your browser.

What is this password strength tester?

This free, browser-only tool measures the real strength of a password by combining character-pool entropy with pattern detection (common-password lists, sequences, repeats, dates, keyboard runs and dictionary words), then projects realistic crack-times against four attacker scenarios.

How strong is my password really?

Type or paste a password and the tester shows its effective entropy, four crack-time estimates and exactly which patterns weaken it — all locally in your browser.

Key features

Four-scenario crack-time

See how long an online throttled, online unthrottled, offline bcrypt and offline MD5-GPU attack would take.

Pattern detection

Catches common passwords, sequences (1234, abc), keyboard runs (qwerty), repeats, years and date-like numbers.

Actionable suggestions

Tells you exactly what to add or remove to reach the next strength tier.

Private by design

Nothing is uploaded; the password lives only in the DOM and disappears on Clear.

Frequently asked questions

Is the password I type sent to a server?

No. The entire analysis runs in your browser. Nothing is uploaded, logged or saved to disk — closing the tab forgets the value.

What do the four attack scenarios mean?

They model realistic attacker capabilities: an online attack against a rate-limited login (100/hour), an online attack against an unprotected endpoint (10/second), an offline crack against a slow hash like bcrypt (10K/second), and an offline crack against a fast hash like MD5 or SHA-1 on modern GPUs (10 billion/second).

Why does the tool flag my password as weak when it has symbols?

Strength is not just about character variety. If the password is short, follows a common pattern (Password1!), contains a dictionary word, dates or keyboard runs, those patterns drastically reduce real-world entropy — even with a symbol thrown in.

Does it check breach databases?

It checks a built-in list of 2,000 of the most common passwords from public breach compilations. It also offers an optional one-click Have I Been Pwned check that uses k-anonymity — only the first five characters of your password's SHA-1 hash are ever sent, so the password itself never leaves your browser.

Penalty heuristics and rate assumptions are calibrated against the open-source zxcvbn estimator and current GPU benchmarks. Strength tiers map to NIST SP 800-63B guidance on memorized-secret entropy.