Password Strength Checker
A password strength checker powered by Dropbox's zxcvbn engine — the same algorithm used by major sites like Stripe, GitLab and 1Password. It estimates how many guesses an attacker would need by recognising common dictionaries, leaked-password lists, keyboard sequences, dates, and repeats — not just counting character classes.
How to use
The score updates with every keystroke. Click the eye icon to toggle visibility.
Aim for a score of 3 or 4. If you see warnings, address them — adding a "1!" rarely helps.
Web service login? Online throttled. Database breach? Offline fast hash — and that's the row that matters most.
Add length and unpredictability until the score is 4 across all rows.
Test how guessable your password really is — based on real dictionaries, patterns, and breach data
Time to crack
Features
FAQ
Where does the password scoring happen?
The zxcvbn estimator runs in your browser via JavaScript on every keystroke — same client-side library Stripe signup, GitLab account creation, 1Password and Dropbox use. No /run endpoint exists for this tool; the scoring logic is shipped in the page assets and computed locally in your tab.
What is zxcvbn?
A password strength estimator created by Dropbox engineer Daniel Lowe Wheeler. Instead of counting character classes, it estimates the number of guesses needed using dictionaries, common patterns, and l33t substitution recognition. Used in production by Stripe, GitLab, 1Password and many others.
Why does "Password123!" get a low score?
Because it appears in the top 1000 of every leaked-password list, and the "123!" suffix is the most common modification. An attacker tries these first.
What score is "safe"?
Score 4 (10⁹+ guesses) is safe against offline attacks. Score 3 is safe against online attacks. Score 2 and below is unsafe in any scenario.
Should I trust the time estimates?
They are conservative estimates against well-equipped attackers. Real adversaries vary, but if a password falls under "offline fast hash, < 1 hour", it is unsafe for any database that could leak.
Why is length more important than symbols?
Because adding one character of length multiplies the search space by the alphabet size; adding a symbol only switches one character. A 16-character all-lowercase password resists more guesses than a 10-character "complex" one.
