Is it safe to type my real password here?

The strength estimate runs entirely in your browser in JavaScript; the page does not save, log or send what you type, and nothing is written to storage. The network is only used if you click the breach-check button, and then only the first 5 characters of the SHA-1 hash are sent. If you prefer, test a similar password with the same structure instead.

How does the breach check protect my privacy?

It uses Have I Been Pwned’s k-anonymity range API. Your browser hashes the password with SHA-1 (40 hex characters) and sends only the first 5. The server replies with every breached hash suffix that starts with those 5 characters — usually hundreds, plus random padding — and the remaining 35 characters are compared locally, so the service cannot tell which password you checked.

How are the crack times calculated?

The checker finds every recognizable pattern, uses dynamic programming to pick the split with the fewest total guesses, and assumes an attacker succeeds after trying half of them: 100 guesses per hour for a rate-limited online attack, 10 per second unthrottled, 10,000 per second offline against bcrypt-style slow hashes, and 10 billion per second offline against fast hashes like MD5 or SHA-1 on GPUs. Treat the results as orders of magnitude.

What makes a strong password?

Length beats complexity: aim for at least 12–16 characters, ideally a passphrase of four or more random, unrelated words or a random string from a password manager. Avoid birthdays, names, phone numbers, keyboard walks and common passwords with a number tacked on. Use a unique password for every site and turn on two-factor authentication for important accounts.

🛡️

🛡️Password Strength Checker - Crack Time & Breach Check

“P@ssw0rd!” has upper and lower case, a digit and a symbol, yet it falls in seconds. Instead of just counting character types, this checker looks for the patterns real attackers try first: common passwords and words (including reversed spellings and l33t swaps like @ for a or 0 for o), keyboard walks (qwerty, 1qaz2wsx), sequences (abc, 1234), repeats (aaa, abcabc), dates and years, and pinyin names (zhangwei1990). It then finds the split that needs the fewest guesses and shows the estimated entropy plus crack times for four scenarios: rate-limited online, unthrottled online, offline slow hash and offline fast hash. Every detected pattern is listed with concrete advice. Optionally, check whether the password appears in known breaches through Have I Been Pwned’s k-anonymity API — only the first 5 characters of its SHA-1 hash are sent, and the password never leaves your device.

Free · No sign-up · Runs in your browserLast updated: 2026-10-26

Loading tool...

How to use Password Strength Checker

1Type the password you want to test (hidden by default)
2Review the strength rating, estimated entropy, crack times and detected patterns
3Improve the password using the suggestions, and optionally run the breach check

FAQ

Is it safe to type my real password here?: The strength estimate runs entirely in your browser in JavaScript; the page does not save, log or send what you type, and nothing is written to storage. The network is only used if you click the breach-check button, and then only the first 5 characters of the SHA-1 hash are sent. If you prefer, test a similar password with the same structure instead.
How does the breach check protect my privacy?: It uses Have I Been Pwned’s k-anonymity range API. Your browser hashes the password with SHA-1 (40 hex characters) and sends only the first 5. The server replies with every breached hash suffix that starts with those 5 characters — usually hundreds, plus random padding — and the remaining 35 characters are compared locally, so the service cannot tell which password you checked.
How are the crack times calculated?: The checker finds every recognizable pattern, uses dynamic programming to pick the split with the fewest total guesses, and assumes an attacker succeeds after trying half of them: 100 guesses per hour for a rate-limited online attack, 10 per second unthrottled, 10,000 per second offline against bcrypt-style slow hashes, and 10 billion per second offline against fast hashes like MD5 or SHA-1 on GPUs. Treat the results as orders of magnitude.
What makes a strong password?: Length beats complexity: aim for at least 12–16 characters, ideally a passphrase of four or more random, unrelated words or a random string from a password manager. Avoid birthdays, names, phone numbers, keyboard walks and common passwords with a number tacked on. Use a unique password for every site and turn on two-factor authentication for important accounts.