How to check a password's strength
- Type or paste a password. Use "Show" to see what you typed.
- Read the score from 0 (very weak) to 4 (strong) and the estimated crack times.
- Follow the suggestions, or add personal words such as your name to see if they make it easier to guess.
The word lists (about 1 MB) are downloaded from this site the first time you type, then reused. For real accounts, test a password similar to yours rather than the exact one, and let a password manager generate the final one.
Questions
Is the password I type sent anywhere?
No. The check runs entirely in your browser. The password is never uploaded, logged, or stored, and the page makes no network request while you type.
Why is there no "has this password been leaked?" check?
Leak-check services need to receive at least part of your password, or a hash of it, over the internet. That would break this site's rule that your data stays on your device, so we left it out. Use a password manager with a built-in breach check if you want one.
How is the strength calculated?
The tool uses zxcvbn-ts, which estimates how many guesses an attacker would need by looking for common passwords, names, dictionary words, keyboard patterns like "qwerty", repeats, sequences, and dates. This is more realistic than rules like "one capital and one symbol".
Can I trust the crack-time estimates?
Treat them as rough guides. They assume a particular guessing speed, and real attackers vary. A score of 3 or 4 together with a password that is unique to one account is a good target.
What makes a password strong?
Length and unpredictability. A random string or four or more unrelated words beats a short password with substitutions such as "P@ssw0rd". Never reuse a password between accounts.
Credits
Built on zxcvbn-ts (MIT). OneTooling is not affiliated with that project.