Password Strength Checker

About the Password Strength Checker

Most strength meters count character types, but attackers do not guess that way: they try common passwords, dictionary words, names, keyboard patterns, dates and predictable substitutions first. This checker uses zxcvbn-ts, the open-source TypeScript edition of Dropbox's zxcvbn estimator (Wheeler, USENIX Security 2016), with 49,233 common passwords, about 187,000 English words and names and six keyboard layouts. It estimates how many guesses a smart attacker would need, how long that takes in four attack scenarios, and which part of the password gives it away.

A checklist applies the password rules of NIST's Digital Identity Guidelines (SP 800-63B-4): length, blocklists of common and dictionary passwords, personal details and Unicode handling. Check breaches looks the password up in Have I Been Pwned without sending it. Everything else happens on your device; nothing you type is stored.

Common uses

• Checking a password you made up before using it for an important account.
• Seeing why a password a site rejected is weak, and what to change.
• Explaining password strength to family, students or colleagues with real examples.
• Checking passwords against NIST SP 800-63B-4 rules while designing a sign-up form.

How the estimate works

zxcvbn splits the password into the cheapest-to-guess sequence of patterns — dictionary words (including reversed words and l33t substitutions such as @ for a), look-alike misspellings of listed words, keyboard patterns on QWERTY, QWERTZ, AZERTY, Dvorak and number pads, repeats, sequences, dates and recent years — and multiplies the guesses each part needs. Characters that match no pattern count 10 guesses each. The score follows zxcvbn's thresholds: under 10³ guesses scores 0, under 10⁶ scores 1, under 10⁸ scores 2, under 10¹⁰ scores 3, and 10¹⁰ or more scores 4.

That models how real cracking tools work, which is why "P@ssw0rd!" scores far lower than a meter that counts symbols would suggest. The look-alike search is slower, so it runs a moment after you stop typing.

The four attack scenarios

The crack times use zxcvbn's standard assumptions:

• Online, rate-limited — 100 guesses per hour against a website that limits failed sign-ins.
• Online, no rate limit — 10 guesses per second.
• Stolen database, slow hash — 10⁴ guesses per second against salted bcrypt, scrypt, Argon2 or PBKDF2 hashes, with several attackers.
• Stolen database, fast hash — 10¹⁰ guesses per second against salted MD5, SHA-1 or SHA-256 on graphics cards.

You cannot know how a site stores your password, so judge important passwords by the fast-hash scenario — and never reuse a password, because one breached site is enough.

NIST SP 800-63B-4 password rules

The NIST Digital Identity Guidelines (section 3.1.1.2) tell services — some points as requirements, others as recommendations — to:

• require at least 15 characters for passwords used on their own, and at least 8 for passwords used only with multi-factor authentication;
• accept at least 64 characters, all printable ASCII characters, spaces and Unicode, counting each Unicode code point as one character (and normalise it with NFC);
• impose no composition rules — no "must contain a digit and a symbol" — and no periodic password changes, but force a change when there is evidence of compromise;
• compare every new password, as a whole, against a blocklist of commonly used, expected or compromised passwords: breach corpuses, dictionary words and context-specific words such as the service name or username;
• allow password managers, autofill and paste, and limit failed sign-in attempts.

The checklist on this page applies the rules that can be checked from the password alone.

About the word lists

zxcvbn-ts is MIT-licensed (© Dan Wheeler, Dropbox and the zxcvbn-ts contributors). Its English common-word list is derived from the OpenSubtitles 2024 corpus provided by OPUS (Helsinki-NLP), used under the Open Data Commons Attribution Licence (ODC-BY); the other lists cover common passwords, first names, surnames, words frequent on English Wikipedia and the EFF Diceware words. They are about 0.9 MB compressed, downloaded from MySmartCoPilot the first time you type and then kept by your browser.

Limitations

• It is an estimate, not a guarantee. An attacker who knows you personally can do better; a password made by a generator is stronger than estimated, because unexplained characters only count 10 guesses each.
• The dictionaries are English, so words from other languages are treated as random characters and may be rated too highly.
• Only the first 256 characters are analysed.
• If the look-alike search takes too long for a password (mostly ones full of digits and symbols), the result without it is shown and marked.

Privacy

The strength check runs in your browser: what you type is never uploaded, stored or logged. The first time you type, zxcvbn's word lists (about 0.9 MB) are downloaded from MySmartCoPilot. Only if you press Check breaches are the first 5 characters of the password's SHA-1 hash — never the password — sent to Have I Been Pwned's Pwned Passwords API.