How to use Password Strength Tester
The Password Strength Tester evaluates how secure a password is using entropy analysis and pattern matching via the zxcvbn library. It returns a score from 0 (very weak) to 4 (very strong), an estimated time to crack using different attack models, and specific suggestions to improve the password. Analysis happens entirely in your browser — your password is never uploaded or logged.
- Type or paste a password into the input field — it is never sent to any server.
- The strength score (0–4) and a colour-coded bar appear instantly.
- Read the estimated crack time to understand the real-world risk.
- Check the feedback section for specific warnings (e.g., "This is a top-10 password") and suggestions.
- Use the show/hide toggle to view the password characters while editing.
Your data never leaves your device — 100% private processing.
How zxcvbn measures password strength
zxcvbn (developed by Dropbox) takes a fundamentally different approach to strength measurement than simple rules like "must contain a number". It pattern-matches against a dictionary of 30,000+ common words, names, common passwords, and keyboard patterns (qwerty, 123456). It detects l33t-speak substitutions, date patterns, sequences, and repeated characters. The score reflects the estimated number of guesses required for a fast offline attacker, mapped to a 5-level scale. A password that passes typical complexity rules (8 chars, uppercase, number, symbol) might still score 1/4 if it is a dictionary word with predictable substitutions.
| Score | Label | Guesses needed | Crack time (offline, slow hash) |
|---|---|---|---|
| 0 | Very Weak | < 1,000 | Instant |
| 1 | Weak | < 1,000,000 | Seconds |
| 2 | Fair | < 1,000,000,000 | Hours |
| 3 | Strong | < 1,000,000,000,000 | Months |
| 4 | Very Strong | ≥ 1,000,000,000,000 | Centuries |
What makes a password truly strong
Length is the single most important factor. A 20-character passphrase of four random common words (correct-horse-battery-staple) has far more entropy than an 8-character string mixing symbols. Unpredictability matters more than complexity: substituting @ for a in "password" adds almost no entropy because attackers test these substitutions first. Unique passwords per account prevent credential-stuffing attacks where one breach enables access to dozens of other services. A password manager eliminates the need to memorise long, random credentials — use one to generate and store 20+ character random passwords for every site.
Worked examples
Weak despite complexity
Inputs: 'P@ssw0rd1!'
Result: score 1/4 — predictable substitutions
Long passphrase
Inputs: 'correct-horse-battery-staple'
Result: score 4/4 — centuries to crack
Top-10 password
Inputs: '123456'
Result: score 0/4 — cracked instantly
Glossary
- Entropy
- A measure of unpredictability in bits; each extra bit doubles the number of guesses needed to crack a password.
- Brute force
- An attack that systematically tries every possible password combination; made impractical for long passwords by the exponential search space.
- Dictionary attack
- An attack using a list of common words, phrases, and previously leaked passwords; defeats predictable passwords even when they appear complex.
- Credential stuffing
- Using username/password pairs from one data breach to try logging into other services, exploiting password reuse.
- Passphrase
- A password made of multiple random common words; long, memorable, and difficult to crack due to high entropy.
Related reading
Frequently Asked Questions
Why use Password Strength Tester?
- Score password strength using entropy analysis and pattern detection via the zxcvbn library
- See the estimated crack time under both fast-hash and slow-hash offline attack models
- Receive specific suggestions for improving a weak password rather than generic complexity rules
- Detect dictionary words, keyboard walks, and l33t-speak substitutions that reduce entropy
Common use cases
- Test a default password policy to confirm it rejects common passwords scoring below 3/4
- Evaluate a passphrase's entropy before using it as a master password for a password manager
- Demonstrate why P@ssw0rd1! scores weak despite containing uppercase, numbers, and symbols
- Compare candidate passwords to choose the strongest one for a long-lived service account
- Identify that a custom password contains a keyboard walk (qwerty) before deploying it
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
Password Generator
Generate strong, secure, random passwords instantly. Uses the Web Crypto API — nothing is sent to any server, so your passwords stay private.
GraphQL Query Tester
Test GraphQL endpoints with query, variables, and headers, inspect data/errors, and explore introspection schema in-browser, with proxy fallback for CORS.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser. Free, private, and secure for quick checks.
AES Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM and a password. Strong, standards-based encryption in your browser. Free and private.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Regex Tester
Test and debug regular expressions online. See live matches, capture groups, and replace output. Free, private, instant.
Explore all Developer Tools.