Password Strength Tester
Type a password to see its strength score, estimated time to crack, and specific suggestions — analyzed in your browser, never uploaded.
Your password never leaves your browser — analysis runs entirely on your device.
How to use Password Strength Tester
The Password Strength Tester evaluates how secure a password is using entropy analysis and pattern matching via the zxcvbn library. It returns a score from 0 (very weak) to 4 (very strong), an estimated time to crack using different attack models, and specific suggestions to improve the password. Analysis happens entirely in your browser — your password is never uploaded or logged.
- Type or paste a password into the input field — it is never sent to any server.
- The strength score (0–4) and a colour-coded bar appear instantly.
- Read the estimated crack time to understand the real-world risk.
- Check the feedback section for specific warnings (e.g., "This is a top-10 password") and suggestions.
- Use the show/hide toggle to view the password characters while editing.
Your data never leaves your device — 100% private processing.
How zxcvbn measures password strength
zxcvbn (developed by Dropbox) takes a fundamentally different approach to strength measurement than simple rules like "must contain a number". It pattern-matches against a dictionary of 30,000+ common words, names, common passwords, and keyboard patterns (qwerty, 123456). It detects l33t-speak substitutions, date patterns, sequences, and repeated characters. The score reflects the estimated number of guesses required for a fast offline attacker, mapped to a 5-level scale. A password that passes typical complexity rules (8 chars, uppercase, number, symbol) might still score 1/4 if it is a dictionary word with predictable substitutions.
| Score | Label | Guesses needed | Crack time (offline, slow hash) |
|---|---|---|---|
| 0 | Very Weak | < 1,000 | Instant |
| 1 | Weak | < 1,000,000 | Seconds |
| 2 | Fair | < 1,000,000,000 | Hours |
| 3 | Strong | < 1,000,000,000,000 | Months |
| 4 | Very Strong | ≥ 1,000,000,000,000 | Centuries |
What makes a password truly strong
Length is the single most important factor. A 20-character passphrase of four random common words (correct-horse-battery-staple) has far more entropy than an 8-character string mixing symbols. Unpredictability matters more than complexity: substituting @ for a in "password" adds almost no entropy because attackers test these substitutions first. Unique passwords per account prevent credential-stuffing attacks where one breach enables access to dozens of other services. A password manager eliminates the need to memorise long, random credentials — use one to generate and store 20+ character random passwords for every site.
Glossary
- Entropy
- A measure of unpredictability in bits; each extra bit doubles the number of guesses needed to crack a password.
- Brute force
- An attack that systematically tries every possible password combination; made impractical for long passwords by the exponential search space.
- Dictionary attack
- An attack using a list of common words, phrases, and previously leaked passwords; defeats predictable passwords even when they appear complex.
- Credential stuffing
- Using username/password pairs from one data breach to try logging into other services, exploiting password reuse.
- Passphrase
- A password made of multiple random common words; long, memorable, and difficult to crack due to high entropy.
Related reading
Frequently Asked Questions
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Why use Password Strength Tester?
- No installation — use directly from any browser
- Handles large inputs without crashing or timeouts
- Syntax highlighting and formatted output for readability
- Copy to clipboard shortcut for fast workflow integration
Common use cases
- Validate and format JSON responses from APIs
- Encode/decode Base64 strings during debugging
- Generate UUIDs for database seeds or test data
- Minify CSS or JavaScript before deployment
- Diff two code snippets to spot regressions
Related Developer Tools
Password Generator
Generate strong, secure, random passwords instantly. Uses the Web Crypto API — nothing is sent to any server, so your passwords stay private.
Hash Generator
Generate cryptographic hashes online. Support for SHA-1, SHA-256, SHA-384, and SHA-512. Instant, secure, client-side.
AES Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM and a password. Strong, standards-based encryption in your browser. Free and private.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Regex Tester
Test and debug regular expressions online. See live matches, capture groups, and replace output. Free, private, instant.
Base64 Encoder & Decoder
Encode text or files to Base64, or decode Base64 strings back to text. Fast, free, and runs entirely in your browser.
Explore all Developer Tools.