Password strength checker
Type a password to see an estimate of its strength, how long guessing would take in three scenarios and exactly what makes it weak. Nothing is sent or stored.
How to use it
- Type the password into the box. The result updates as you type, and nothing is sent anywhere.
- Look at the rating and the time to crack. The leaked-database line matters most – that's how passwords are usually cracked today.
- Read what the tool recognised in the password (words, years, keyboard patterns) and the tips on how to improve it.
- Change a weak password everywhere you use it. You can create a strong new password or passphrase with the password generator.
How it works
Most password strength meters only count length and character types. Attackers don't try every combination, though. They start with lists of leaked passwords and dictionaries, then add what people do most often: a capital first letter, a year at the end, an exclamation mark, "@" instead of "a". That's why Sunshine1985! looks complicated but falls among the first guesses.
How the tool estimates strength
It splits the password into the chunks an attacker would try first and estimates how many guesses each one would cost:
- common passwords and their bases – password, qwerty, letmein, admin and so on, including letter-for-digit swaps (P@ssw0rd),
- words – English and Czech words from its list, plus chunks that look like words (attackers' wordlists hold hundreds of thousands of words in many languages),
- keyboard patterns (qwerty, asdf, 1qaz), letter and number sequences (abcd, 1234) and repetition (aaaa, 121212),
- years and dates (1985, 15081990).
Everything else counts as random. The result in bits is turned into an average time to crack in three scenarios: through a login form, from a leaked database with a slow hash, and from a leaked database with a fast hash.
What a strong password looks like
- One password, one account. Most break-ins aren't guessing at all – they're passwords leaked from another service being tried elsewhere. The UK's NCSC especially recommends a strong, separate password for your email, because it can reset everything else.
- Length over complexity. NIST tells services not to force mixtures of character types; it recommends length and checking against a list of common and compromised passwords. A passphrase of several random words is stronger and easier to remember than a short password full of symbols.
- Random, not your own idea. People choose predictably. Let the password generator create a password or passphrase and keep it in a password manager – see Password manager – how to start.
- Two-step verification on email, banking and social media protects you even if a password leaks.
If you've typed your password into a fake site, follow I entered my details on a phishing site. If someone has already taken over an account, see Hacked account – what to do.
FAQ
Is it safe to type my real password here?
The password is processed by a script right in your browser. Nothing is sent to a server or stored, and no third-party code or ads run on our tool pages. The tool even works offline. Still, the general rule stands: don't type the password for an important account into a site you don't trust. You can test a similar password with the same structure instead.
Why does another site give me a different result?
Every tool calculates differently. Simple calculators just multiply the length by the number of character types, so they rate Password2024! as strong. This tool looks for the patterns attackers actually try (words, years, keyboard runs, swapping letters for digits), so it tends to be stricter.
Does the tool check whether my password has been leaked?
No. Checking a leaked-password database would mean connecting to a third-party service, and we don't do that on our tool pages. If a service where you use the password has reported a breach, change it whatever the result says.
How long does my password need to be?
NIST SP 800-63B-4 requires at least 15 characters for a password that is the only thing protecting an account, and at least 8 when two-step verification is on. Length alone isn't enough, though, if the password is made of predictable words and numbers.
Where do the guessing speeds come from?
They're model scenarios, not measurements: 10 guesses a second through a login form, 10,000 a second against a database with a slow hash (bcrypt, Argon2) and 10 billion a second against a fast hash (MD5, SHA-1) on powerful hardware. Real speeds depend on the service and the attacker's kit, so treat the result as an order-of-magnitude estimate.
Sources
You might also need
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
Apify breach: attacker used a compromised credential to obtain user account credentials
Web scraping and automation platform Apify detected on 11 November 2026 that an unauthorized third party had used a compromised credential on 9 and 10 November to obtain a number of account credentials and access related Apify accounts. The company closed the access path, revoked some OAuth connections including GitHub, and rotated internal secrets. Here is what is confirmed and what users need to do.
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Updated