Password Strength Checker

Check a Password’s Strength

This password checker estimates how hard a password is to guess. Type an entry to see its strength score, estimated guessing times and any common patterns it contains.

The check runs on your device. Your entry stays out of requests, browser storage and the page address. Clear entry removes it. Leaving or reloading the page also clears it.

The score runs from 0, very weak, to 4, very strong. The two offline times give a range for different password-storage methods after an attacker obtains password hashes.

The fast scenario assumes 10 billion guesses per second. The slow scenario assumes 10,000. Real guessing speed depends on the stolen data and the attacker’s equipment. These estimates are not a countdown to account compromise.

The checker uses the zxcvbn guessing model. It does not assess your account’s sign-in limits, multi-factor authentication or password reuse. It does not check whether a password appeared in a breach.

Why Common Patterns Are Weak

Attackers try common passwords and words before exploring random combinations. Familiar substitutions, such as replacing a letter with a number, often leave the underlying word easy to guess.

Dates, repeated groups and keyboard runs also reduce the search. A long row of neighbouring keys can score poorly despite using many characters. The result names the patterns without repeating your password.

A strong score cannot reveal reuse. If a password works on several accounts, someone who obtains it from one service can try it elsewhere.

Making a Password Stronger

Add length through an unpredictable password or a passphrase of unrelated words. Avoid a practice name, a personal date or a familiar quotation. Appending another predictable digit leaves much of the original pattern intact.

The Australian Signals Directorate recommends passwords of at least 15 characters and a different password for every account. Its password guidance also explains using a password manager to create and store them.

Use the password generator to create a replacement. Save the new password in your password manager, then turn on multi-factor authentication wherever the account supports it.