Use the free Password Strength Checker below: your data never leaves your browser — all work happens on your device, and nothing is uploaded to any server.
Why Password Strength Is Hard to Judge by Eye
Most people judge a password by how complicated it looks. A string full of symbols and mixed case feels strong, while a plain word feels weak. That instinct is often wrong. Attackers do not guess character by character; they try whole words, names, dates, keyboard patterns, and passwords leaked from other sites, in clever orders. A password like “P@ssw0rd!” looks complicated, but it is one of the first guesses in every attacker’s list, because millions of people invented the same trick.
Real strength comes from unpredictability: how many plausible guesses an attacker must try before reaching yours. That depends on structure, not appearance. A long, random, unique password is strong even if it contains only lowercase letters. A short password built from a name plus a year is weak even if it is dressed up with symbols. The tool above measures strength the honest way, with zxcvbn, an estimator built from studying real password leaks and real guessing attacks.
How the Checker Works
Type a password into the box and the tool scores it from 0 to 4: very weak, weak, fair, good, or strong. The score is not a grade for effort; it is an estimate of how many guesses an attack would need. Alongside the score you get an estimated crack time for an offline attack, which is the realistic threat when a site’s password database leaks. You also get feedback in plain words, such as a warning that your password is a common word, or a suggestion to add another word.
Everything runs in your browser. The password you type is never sent anywhere, never logged, and never leaves your device. That matters, because a strength checker that uploaded your password would be a trap, not a tool. If you are on a shared computer, though, still avoid testing a password you actually use: shoulder surfing and saved form data are separate risks no web page can remove.
What the Score Means
A score of 0 means the password falls almost immediately: a single common word, a name, a date, or a famous password. A score of 1 means it survives seconds to minutes against a prepared attacker. A score of 2 is fair for a low-value account but not for anything important. A score of 3 is good, and a score of 4 is strong: the kind of password that would take years or centuries to guess offline, assuming the site hashed it properly.
Crack-time estimates are approximate by nature. They assume a fast offline attack against a leaked database, which is the worst case. Against a live login page with rate limits, even a weak password lasts longer, because the site blocks repeated tries. Do not let that comfort you: databases leak regularly, and offline guessing is the threat that decides whether a leak becomes a takeover.
How Attackers Actually Guess
Modern guessing uses dictionaries of leaked passwords, word lists in many languages, names and places, dates, sports teams, and patterns like “word plus year” or “word with letters swapped for digits”. It then combines them: two words together, a word plus a symbol, a name plus a birth year. zxcvbn models exactly this, which is why it rates “correct horse battery staple” highly and “Tr0ub4dor&3” poorly, even though the second looks more complex.
Keyboard patterns are another favourite: “qwerty”, “1qaz2wsx”, and diagonal walks across the keyboard. So are repeated characters and simple sequences like “abcd1234”. If your password contains any of these, the checker will usually say so, and the fix is not to decorate the pattern with a symbol but to abandon the pattern entirely.
How to Build a Strong Password
The simplest reliable recipe is a passphrase of four or more random words, unique to each site. If you prefer a single password, make it long, random, and unrelated to your life, and store it in a password manager. Length beats complexity every time: each extra random character or word multiplies the attacker’s work, while a clever symbol swap adds almost nothing once the attacker knows the trick.
Never reuse a password across sites. Reuse is the single biggest cause of account takeover, because one leak hands attackers a key that fits many doors. If remembering many passwords feels impossible, that is the sign you need a password manager, not simpler passwords. Let the manager generate and remember them, and protect the manager itself with one strong master passphrase plus two-factor authentication.
Common Questions
Does changing passwords regularly help? Only if a password may have leaked. Forced rotation without a reason mostly produces weaker passwords, because people make small predictable changes. Change a password when there is a reason: a breach, a leak alert, a shared computer, or a suspicion it was seen.
Are password managers safe? They are far safer than reuse and sticky notes. Choose a reputable one, use a strong master passphrase, turn on two-factor authentication, and keep a backup of your recovery information somewhere safe. No system is perfect, but a manager moves you from the most common failure, reuse, to a much rarer one.
What about passkeys? Passkeys are even better where offered, because there is nothing to guess or leak in a usable form. Use them when a site offers them, and keep strong unique passwords as the fallback for everything else.