Skip to the tool
CALCPARK

Password Strength Checker

Test how strong a password is: a 0–4 zxcvbn score, crack times for four attack scenarios, pattern warnings and a length checklist. Nothing leaves your browser.

Runs on your device
Loading the tool…

How to use it

  1. Type or paste the password. The engine loads once on the first keystroke and then scores every change instantly.
  2. Read the score and the warning: it names the pattern that makes the password guessable (a common word, a date, a keyboard walk).
  3. Compare the four crack-time rows. The “offline, fast hash” row is the one to worry about after a site breach.
  4. Fix what the checklist and suggestions point at – usually add length or an extra unrelated word – and watch the score move. Copy the summary if you need to document the check.

Example

password123 scores 0 / 4: zxcvbn finds it in its list of leaked passwords at roughly 102.9guesses, so even a throttled login form (100 guesses an hour) falls in about 8 hours and an offline attack is instant.Summer2024! scores 2 / 4 at about 107.5guesses – 37 years against a throttled form, but under an hour against a leaked bcrypt hash and milliseconds against MD5. The checklist would still mark it as “4 classes used”, which is exactly why variety rules alone mislead.

How the score is calculated

zxcvbn breaks the password into overlapping matches (dictionary words from several lists, names, reversed and l33t-speak variants, spatial keyboard sequences, repeats, number and letter sequences, dates, and plain brute force for the rest) and searches for the cheapest sequence of matches that covers the whole string. The number of guesses that sequence costs is the strength estimate; scores map onto guess counts.

score 0: < 10³ guesses · 1: < 10⁶ · 2: < 10⁸ · 3: < 10¹⁰ · 4: ≥ 10¹⁰ guesses      crack time = guesses ÷ guesses per second

The four rates are the ones zxcvbn uses: 100 guesses per hour and 10 per second for online attacks, 10,000 per second for a slow server-side hash (bcrypt, scrypt, Argon2, PBKDF2) and 10 billion per second for a fast unsalted hash on GPUs. The engine is the TypeScript port @zxcvbn-ts/corewith the common and English dictionaries, loaded in the browser on the first keystroke. The composition panel shows length × log₂(alphabet), the brute-force upper bound a random password of the same shape would have; the real estimate is usually much lower.

Limits. Unmatched text is costed at 10 guesses per character, so a truly random 16-character password shows 1016 guesses rather than its real 1031; the score is still 4. The dictionaries are English, so a common word in another language may be rated too high. A strong score cannot protect a password that is reused on a breached site.

Sources: Wheeler, D. L. – zxcvbn: Low-Budget Password Strength Estimation (USENIX Security 2016), @zxcvbn-ts documentation, NIST SP 800-63B-4 – password verifiers.

Is it safe to type a real password here?

The check runs entirely in the page: the code only reads the input field, computes the score and renders it. Nothing is sent, cached or added to the URL, and the field has autocomplete disabled so browsers and password managers do not offer to save it. If you still prefer not to, test a password of the same construction – the score depends on the pattern, not the exact letters.

Questions

Why does a password with symbols and numbers score low?
Because it is built from a predictable pattern: a word, a year, an exclamation mark. Attackers try those combinations first, so “Summer2024!” costs about 10^7.5 guesses even though it uses all four character classes. Two or three unrelated words beat a decorated single word.
What does the crack time actually mean?
Guesses needed divided by guesses per second for each attack model. Online figures assume the login form is the bottleneck; offline figures assume the attacker already has the site’s password database and is limited only by hashing speed.
Which score should I aim for?
Score 4 for anything important (email, bank, password manager). Score 3 is acceptable for low-value accounts with two-factor authentication. Scores 0–2 should be replaced; the Password Generator produces score-4 passwords by default.