# Password Strength Checker - Crack Time & Breach Check

> Test password strength privately in your browser: entropy and crack time, detects common passwords, keyboard walks, dates and l33t, optional breach check.

- URL: https://qilingtools.com/en/password-checker
- Category: Productivity (https://qilingtools.com/en/office)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Productivity](https://qilingtools.com/en/tags/office)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

“P@ssw0rd!” has upper and lower case, a digit and a symbol, yet it falls in seconds. Instead of just counting character types, this checker looks for the patterns real attackers try first: common passwords and words (including reversed spellings and l33t swaps like @ for a or 0 for o), keyboard walks (qwerty, 1qaz2wsx), sequences (abc, 1234), repeats (aaa, abcabc), dates and years, and pinyin names (zhangwei1990). It then finds the split that needs the fewest guesses and shows the estimated entropy plus crack times for four scenarios: rate-limited online, unthrottled online, offline slow hash and offline fast hash. Every detected pattern is listed with concrete advice. Optionally, check whether the password appears in known breaches through Have I Been Pwned’s k-anonymity API — only the first 5 characters of its SHA-1 hash are sent, and the password never leaves your device.

## How to use

1. Type the password you want to test (hidden by default)
2. Review the strength rating, estimated entropy, crack times and detected patterns
3. Improve the password using the suggestions, and optionally run the breach check

## Features

- Attacker-style estimate: dictionary, keyboard walks, sequences, repeats, dates, pinyin names
- Detects reversed words and l33t substitutions (@→a, 0→o, $→s)
- Estimated entropy compared with naive charset entropy
- Crack times for online/offline and slow/fast hash scenarios
- Specific warnings and suggestions
- Optional k-anonymous breach check (only 5 hash characters sent)
- Runs locally — nothing stored or uploaded
- Link to a random password generator

## FAQ

### Is it safe to type my real password here?

The strength estimate runs entirely in your browser in JavaScript; the page does not save, log or send what you type, and nothing is written to storage. The network is only used if you click the breach-check button, and then only the first 5 characters of the SHA-1 hash are sent. If you prefer, test a similar password with the same structure instead.

### How does the breach check protect my privacy?

It uses Have I Been Pwned’s k-anonymity range API. Your browser hashes the password with SHA-1 (40 hex characters) and sends only the first 5. The server replies with every breached hash suffix that starts with those 5 characters — usually hundreds, plus random padding — and the remaining 35 characters are compared locally, so the service cannot tell which password you checked.

### How are the crack times calculated?

The checker finds every recognizable pattern, uses dynamic programming to pick the split with the fewest total guesses, and assumes an attacker succeeds after trying half of them: 100 guesses per hour for a rate-limited online attack, 10 per second unthrottled, 10,000 per second offline against bcrypt-style slow hashes, and 10 billion per second offline against fast hashes like MD5 or SHA-1 on GPUs. Treat the results as orders of magnitude.

### What makes a strong password?

Length beats complexity: aim for at least 12–16 characters, ideally a passphrase of four or more random, unrelated words or a random string from a password manager. Avoid birthdays, names, phone numbers, keyboard walks and common passwords with a number tacked on. Use a unique password for every site and turn on two-factor authentication for important accounts.

## Related tools

- [QiLing Mind](https://qilingtools.com/en/mindmap): QiLing Mind is a free online mind map editor: add nodes with Tab/Enter, drag to restructure, import and export XMind and Markdown, export PNG/SVG/PDF.
- [Password Generator](https://qilingtools.com/en/password): Free online random password generator: choose length, character sets and look-alike exclusions, generate several at once with a strength meter, all locally.
- [QR Code Generator](https://qilingtools.com/en/qrcode): Free online QR code generator: turn URLs, text, Wi-Fi or contact cards into QR codes with custom size, colour and error correction. Crisp PNG or vector SVG.
- [Word Counter](https://qilingtools.com/en/word-count): Free online word counter: live counts of characters with and without spaces, words, CJK characters, lines, paragraphs, sentences, bytes and reading time.
- [Case Converter](https://qilingtools.com/en/case-convert): Free online case and naming converter: get UPPERCASE, lowercase, Title Case, camelCase, PascalCase, snake_case, kebab-case and CONSTANT_CASE at once.
- [Lorem Ipsum Generator](https://qilingtools.com/en/lorem): Free online Lorem Ipsum generator: classic Latin placeholder text or Chinese filler by paragraph, sentence or word, with one-click copy for mockups.
- [Sort & Dedupe Text](https://qilingtools.com/en/text-sort): Free online text tool: sort lines alphabetically or by length, remove duplicate and empty lines, trim whitespace, optionally ignoring case. Runs locally.
- [Sign & Stamp PDF](https://qilingtools.com/en/pdf/sign): Free online PDF signing tool: drop in a handwritten signature or company stamp, drag it into place on a page preview, adjust size and opacity, then export.