Cryptography & Security

Password Strength Analyser

Type a password to see a realistic strength score, plus how long it would survive an offline brute-force attempt.

Free & unlimitedRuns in your browserNo sign-up required

Password to analyze

Estimated Crack Times

Online (Throttled, 100/hr)centuries

Online (Unthrottled, 10/sec)centuries

Offline (Slow hash, 1e4/sec)centuries

Offline (Fast hash, 1e10/sec)8 hours

Analysis Details

Guesses needed273,500,327,700,640

Entropy (bits)48.0

4/4

Very Strong

Analysis runs completely offline in your browser using Dropbox's zxcvbn library. Your password is never sent to any server.

Password Strength Analyser

Most password strength meters are useless. They reward you for hitting '8 characters, one number, one symbol' while happily rating 'P@ssw0rd1' as strong, even though it's one of the first guesses any real attacker's dictionary makes. A better analyser needs to actually model how attacks work, not just count character types.

Realistic attack modeling

This tool scores a password and shows estimated crack times across several realistic attack scenarios, from a slow online guessing attempt where a server rate-limits login attempts, up to an offline attack where someone has stolen a database of hashes and is throwing a GPU cluster at cracking them as fast as possible. The gap between those two numbers is often enormous.

Unpredictability over complexity

What actually makes a password strong isn't just length and symbols; it's unpredictability. "correcthorsebatterystaple" is a stronger password than "Tr0ub4dor&3" despite looking simpler, because it has more entropy once you account for how attackers actually crack passwords, using dictionaries of common words, leaked password lists, and pattern substitutions like "a" to "@" and "e" to "3".

Real-world usage

People use this to test whether a password they're about to reuse across accounts is actually safe, to build intuition for what makes a password genuinely strong before setting one for something important, to check organizational password policies against realistic attack models, and to demonstrate why "Password123!" fails despite satisfying complexity rules.

The real solution

If there's one habit worth building from using this tool: stop trying to memorize strong passwords and start using a password manager with randomly generated, unique passwords for every account. Length and true randomness beat clever substitutions every time.

Loading tool…

How it works

Three steps, no setup

Type a password

Nothing is logged or transmitted — scoring happens instantly in your browser.

Read the crack-time estimate

See how long different attacker speeds would take to guess it.

Apply the suggestions

Follow the specific feedback to strengthen weak spots like repeated patterns or common words.

Common questions

Frequently asked questions

Why did a long password still score low?

Length helps, but predictable patterns — keyboard walks, dates, dictionary words — are still easy for crackers to guess regardless of character count.

Is it safe to test my real password here?

The analysis runs entirely client-side and nothing is sent anywhere, but as a habit it is best to test a similar dummy password rather than your actual one.

Password Strength Analyser

Password Strength Analyser

Realistic attack modeling

Unpredictability over complexity

Real-world usage

The real solution

Three steps, no setup

Type a password

Read the crack-time estimate

Apply the suggestions

Frequently asked questions

Related tools

Hash Generator

Bcrypt Generator

HMAC Generator

RSA Key Pair Generator

Text Encrypt / Decrypt

BIP39 Mnemonic Generator

twoworks

Password Strength Analyser

Realistic attack modeling

Unpredictability over complexity

Real-world usage

The real solution