Password Strength Checker scores a password from 0 (very weak) to 4 (very strong) with zxcvbn, which estimates how many guesses a password needs by spotting dictionary words, names, dates, keyboard walks and repeats, and turns that into crack times for online and offline attacks. The password is checked on our server and never stored or logged.
How to read the result
The score follows the estimated number of guesses: 0 is under about a thousand, 1 under a million, 2 under 100 million, 3 under 10 billion and 4 more than that. The time to crack table gives four scenarios, from an online login throttled to 100 guesses an hour to an offline attacker with the hash trying 10 billion guesses a second against a fast hash; the same password can last centuries in one and seconds in another.
The warning and suggestions explain what pattern dragged the score down, such as a dictionary word, a keyboard walk, or predictable substitutions like @ for a.
Defender tips
- Length matters more than composition rules; a long passphrase beats a short password with forced symbols nearly every time.
- Require unique passwords per account, enforced by a password manager, rather than one strong password reused everywhere, which fails the moment one site is breached.
- Check new passwords against known breach lists (such as the Have I Been Pwned k-anonymity API) as well as scoring them; a complex-looking password can already be in every attacker's wordlist.
FAQ
Is my password sent anywhere or stored?
It is sent over HTTPS to our API, scored in memory and discarded. It is never logged, stored, put in a share link or saved in your tool history. We record only that a check ran (the time, your IP address and, if you are signed in, your account), never the password.
Why doesn't adding a digit and symbol fix a weak base word?
Pattern-aware scoring accounts for common substitutions and appended characters; password1! is barely stronger than password because the pattern is one an attacker's wordlist already anticipates.
What should I use instead of a single strong password?
A password manager generating a unique, long password per site removes the trade-off entirely: you only need to remember one thing, and a breach on one site cannot be replayed on another.