How to check a password's strength
- Type or paste the password into the box. Press the eye button to show or hide it.
- Read the rating and the estimated time to crack it in four attack situations, from a stolen database to a login page.
- Look at What it found for the words and patterns that make it easier to guess, and follow the tips to make it stronger.
Why one password gets four different times
How fast someone can guess depends on where they’re guessing. Against a login page, a site that limits attempts might allow 100 guesses an hour, and one that doesn’t might allow 10 a second. If a site’s database is stolen, attackers guess offline on their own hardware: about 10,000 guesses a second when passwords were stored with a slow hash such as bcrypt, and about 10 billion a second against a fast hash like MD5 or SHA-1. These are the reference speeds zxcvbn uses; they show the scale, not any particular attacker.
Length beats complexity
Rules like “one capital, one number, one symbol” mostly produce predictable passwords: a capital at the start and a digit and ! at the end. Guessing tools try exactly those changes. Each extra random character or random word multiplies the work instead. A passphrase of unrelated words is both long and easy to type. Our password generator makes random passwords and passphrases on your device.