Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
A meter that counts character classes rates `P@ssw0rd1` strong and `mineral cobbler thrift` weak, and it has both of them backwards: capitalising the first letter, swapping a for @ and adding a trailing 1 are the first rules a cracker tries, not the last. This estimates guesses the way an attacker would count them — by finding the cheapest set of patterns that reconstructs the password.
The password is measured in this tab and nowhere else. It is not sent, not hashed, not stored, and not checked against any breach list — doing that would mean handing part of it to someone else’s server.
How this is measured
Not by counting character classes. This finds the patterns a cracking tool has a cheap rule for — dictionary words, reversed words, lookalike substitutions, keyboard runs, repeats, sequences, dates — and prices the cheapest way to assemble your password out of them. It is an independent implementation of the zxcvbn (Wheeler, USENIX Security 2016) model, matching against 222 common passwords, 353 English words, 99 names and the 7,776-word EFF passphrase list.
A real attacker’s lists are larger than these. A password this page does not recognise may still be in one of them — this is a lower bound on how hard it is to guess, which is the only direction a strength estimate can honestly err.
Need one that scores well? Generate a passphrase or a random password.
How to use it
Type or paste the password
Nothing is hashed, stored or sent. The analysis runs on the string in the tab, which is why no breach database is consulted here — that is a separate tool.
Read the pattern breakdown, not just the score
The tool names each segment it recognised — a dictionary word, a keyboard run, a date, a repeat — and what that segment costs an attacker. The cheap segment is the one to change.
Compare the two attack speeds
The same guess count means years against a slow server login and minutes against an offline attack on a leaked hash. Judge by whichever case applies to where the password lives.
Common questions
Is this zxcvbn?
It follows the published algorithm (Wheeler, USENIX Security 2016) but it is an independent implementation with this project’s own, much smaller dictionaries. The numbers are in the same shape as zxcvbn’s, not identical to them.
It says my password is strong. Is it safe?
It means this tool found no cheap pattern in it. A word list an attacker owns and this tool does not still breaks it, and a password reused on a site that has already been breached is broken regardless of its score. Check it against the breach tool as well.
Why does adding a symbol at the end barely help?
Because it is a rule, and rules are cheap. A cracking run appends every symbol to every dictionary word as a matter of course, so one symbol multiplies the work by a few dozen rather than by the alphabet size. Adding words multiplies it far more.
Does the password leave the tab?
No. There is no network request in this tool at all — not even a hash prefix, which is why the breach lookup is deliberately kept separate.
Feed it from
bcrypt & argon2 Checker
Hashes a password with bcrypt at a chosen cost and checks a password against an existing bcrypt hash. Detects argon2 but does not compute it.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).
Next
These accept what this tool produces, so the result can go straight in.
Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).
Entropy Meter
Measures the Shannon entropy of a string or file and shows a byte histogram — useful for spotting keys.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.