Password strength tester
Type a password to see an estimate of its strength and crack time. It's checked locally, never sent anywhere.
How to use the password strength tester
- Type a password (or one of similar style) into the box.
- Read the strength rating and estimated crack time.
- Lengthen it or use a passphrase if it's weak.
How this estimate works
Strength is estimated from length and the character variety used, expressed as bits of entropy, with an offline crack-time estimate at ~10 billion guesses/second. It runs entirely in your browser and nothing is transmitted, but the safest habit is to test a password of similar style rather than one you actively use. Need a stronger one? Generate a random password or a passphrase.
Code & API examples
Use this from the command line or your code.
Python (zxcvbn)
# pip install zxcvbn
from zxcvbn import zxcvbn
print(zxcvbn('correct horse battery staple')['guesses'])See all endpoints at /api/tools/.
Frequently asked questions
The check runs entirely in your browser and nothing is transmitted. Still, the safest habit is to test a password of similar style rather than one you actively use.
16 characters or more for a random password, or 5-6 random words for a passphrase. Length matters more than swapping letters for symbols.
By estimating entropy: how many guesses an attacker would need on average. The estimate considers length, character variety, and common patterns like dictionary words and keyboard runs.
Short passwords score low even with symbols, and predictable tricks like P@ssw0rd! are in every cracking list. The tester penalizes recognizable patterns, not just missing character types.
No: it analyzes the password's structure locally and sends nothing. To check exposure in known breaches, use a service that queries with a privacy-preserving hash prefix.
Entropy, measured in bits, is the log of the number of equally likely possibilities. Each added bit doubles the guessing effort; roughly 70+ bits is strong against offline attacks.
It depends on the attacker's hardware, whether the site hashed passwords properly, and whether they guess online or offline. The figure shows relative strength, not a guarantee.
Not by themselves. Such rules push people toward predictable substitutions. A long random password or passphrase beats any short string that merely satisfies composition rules.
No. Even a perfect password becomes a liability when reused, because one site's breach hands attackers your login for every other site. Strength and uniqueness are separate requirements.
Be cautious: meters embedded in forms can vary wildly and some send input to a server. A local-only tester like this one is safer, but treat any score as guidance, not gospel.
Barely, if the rest is predictable: attackers append common symbols automatically. Real gains come from more random length, not a decorative character tacked on the end.
If it's genuinely random, a shorter string can still rate well, but verify it isn't based on a word or pattern the meter failed to spot. When unsure, lengthen it; length is cheap insurance.
Related tools
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee for free