Password Strength Checker
Evaluates password strength using zxcvbn entropy analysis: 0–4 score, crack-time estimate, warnings, and fix suggestions. Sensitive data never leaves your device — encryption runs locally in your browser.
Runs on zxcvbn
How to Use the Password Strength Checker
Similar Tools You Might Need
See allPrivacy Cleaner
Scan and clear cookies, localStorage, and sessionStorage for the current site — see what's stored first. Audit privacy trackers before wiping — local inspection, free, no signup.
EXIF Data Remover
Strips EXIF GPS coordinates, camera metadata, timestamps, and software fingerprints from JPEG and PNG images. Sensitive data never leaves your device — stripping runs locally in your browser.
Secure Note Sharer
Share secrets securely via self-decrypting note links — AES ciphertext in the URL fragment, key in the link query. Send passwords without trusting inboxes — local crypto-js AES, free, no signup.
Brute Force Time Estimator
Estimate password crack times from length, charset, and attacker speed — entropy made visceral. Show why 8-char passwords fall in hours — local math, free, no signup.
Password Entropy Calculator
Calculate password entropy in bits to measure password strength against brute-force attacks. Code never leaves your device — formatting and validation run locally in your browser.
Frequently Asked Questions
What does the score mean?
zxcvbn scores 0–4 from real-world cracking models (not just length): 0–1 fall in seconds (dictionary words, patterns), 2 takes hours, 3 takes years, 4 takes centuries. Aim for 3+ on important accounts, 4 on email and banking. The meter fills up to 4 segments with labels Very Weak (0) through Extremely Secure (4); crack time is quoted at 10 billion guesses/second.
Why is 'Tr0ub4dor&3' weak but 'correct horse battery staple' strong?
Leetspeak substitutions are in every cracking dictionary — that 11-character example falls in ~3 days. Four random common words (≈44 bits) take centuries despite looking simple. Length beats complexity theater.
How do I fix a weak score?
Add length first (each character multiplies guessing work), then uniqueness (never reuse), then unpredictability (avoid names, dates, keyboard walks like 'qwerty123'). Regenerate with the Password Generator if editing feels hopeless.
Does it check breach databases?
No — zxcvbn estimates guessability from patterns, it doesn't know if your exact password leaked. Check Have I Been Pwned separately; if breached, change it everywhere it was reused, immediately.
Is my password uploaded?
No. Analysis runs entirely in your browser via zxcvbn. Passwords never leave your device — which is the only safe way to check them.
Related Privacy Tools
PGP Key Generator
Generate PGP key pairs with OpenPGP.js — public for sharing, private stays local. Encrypt mail like it's 1991 but working — local crypto, unlimited saves.
Secure Note Sharer
Share secrets securely via self-decrypting note links — AES ciphertext in the URL fragment, key in the link query. Send passwords without trusting inboxes — local crypto-js AES, free, no signup.
Last updated October 2026