Password strength checker (zxcvbn)
Estimate how many guesses a password would really take, with crack times for four attack scenarios and the patterns that gave it away.
Input
Result
The result will appear here.Rules like 'eight characters with a digit and a symbol' rate P@ssw0rd1 as strong, which it is not: it is the first thing any cracking tool tries. zxcvbn, created at Dropbox (dropbox/zxcvbn, 16k stars), estimates strength the way an attacker works instead — by finding dictionary words, names, keyboard walks, dates, repeats and l33t substitutions in the password and counting how many guesses that structure really leaves. This page runs zxcvbn-ts (zxcvbn-ts/zxcvbn, MIT), the maintained TypeScript port, with its common-password and English dictionaries. Nothing you type leaves the page: there is no network request and no breach lookup.
How it works
- The password is split into the cheapest-to-guess sequence of patterns, and the guesses for each part are multiplied into a total, shown as a power of ten.
- The 0–4 score is set by that total: under 10^3 guesses scores 0, under 10^6 scores 1, under 10^8 scores 2, under 10^10 scores 3, and anything above scores 4.
- Crack times assume 100 guesses an hour (a throttled login form), 10 a second (an unthrottled one), 10,000 a second (a stolen bcrypt or scrypt database) and ten billion a second (a stolen unsalted fast hash on GPUs).
- Add your name, username or the site's name as context and zxcvbn treats them as the first words an attacker would try against this particular account.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
This tool is free, with no sign-in and no points.
Common questions
- Which crack time should I believe?
- The one that matches how the password is stored. For an account on a well-run service, the slow-hash offline figure is the realistic worst case after a breach. The fast-hash figure is for passwords stored badly — unsalted MD5 or SHA-1 — or for things attacked offline directly, such as an encrypted ZIP file or a Wi-Fi handshake.
- Why does a long random-looking password get a low score?
- Because it is not random to zxcvbn. Keyboard walks like 1qaz2wsx, reversed words, years, repeated chunks and substitutions like @ for a are all patterns it models, each costing an attacker only a handful of guesses. The matched patterns list shows exactly which part was found.
- Does it check whether my password has been leaked?
- No, deliberately. A breach check means asking a service such as Have I Been Pwned about a hash prefix, which is a network request, and this page makes none. zxcvbn's built-in list of common passwords does catch the most-leaked ones offline.
- Is it reliable for Chinese or pinyin passwords?
- Less so. The dictionaries loaded here are the common-password list and English words and names, so pinyin syllables and Chinese phrases that are not in them are counted as arbitrary letters, and the estimate can be too generous. Treat a good score for a pinyin password with suspicion.
- What is 'guesses 10^x'?
- The estimated number of attempts an attacker working from common patterns would need, as a power of ten. It is more useful than 'bits of entropy' for human-made passwords, because it reflects the guessing order real cracking tools use rather than the size of the alphabet.
The open-source behind it
This tool runs on zxcvbn-ts/zxcvbn, released under MIT. If you need the same behaviour inside your own program, that is the library to reach for.
zxcvbn-ts/zxcvbnAlso known as
- password strength checker
- zxcvbn
- how secure is my password
- password crack time
- test password strength
- password entropy