Type or paste a password into the field; the strength bar, score, and crack-time estimate update as you type. Use the Show button to verify what you typed.
The score comes from zxcvbn, a pattern-matching and dictionary-attack model, not a simple length or character-class rule. It checks the password against common passwords, keyboard patterns, dates, and predictable substitutions, then estimates how long it would take to crack under an online-throttled attack and an offline fast-hashing attack. Nothing you type is uploaded, logged, or checked against a breach database - the score is computed entirely in this browser tab.
Password Strength Checker
Check how strong a password is before you use it - a 0 to 4 score, an estimated crack time, and specific suggestions.
The score comes from zxcvbn, the same pattern-matching + dictionary-attack model used by Dropbox, not a simple length/character-class rule - it flags common passwords and predictable patterns that "P@ssw0rd1" style rules miss.
Everything runs in the browser - no upload, no account, and the password is never sent anywhere, logged, or checked against a breach-database API.
What the Show button and starting password actually do
Password Strength Checker fills the password field with a sample password on page load, so a real score, bar, and crack-time readout render before you type anything of your own - clear it or type over it to score your own password instead. The field is a genuine password field (type="password", autocomplete="new-password"), so your browser and password manager treat it as password entry rather than a plain text box, and it will not silently autofill a saved credential into it. The Show button next to the field toggles between masked dots and plain text - and swaps its own label between "Show" and "Hide" - so you can confirm exactly what you typed without pasting it anywhere else to check. The scoring library that powers all of this loads from this site's own vendor folder, not from any third-party CDN, so no outside request even hints that a password is being checked.
How the crack-time estimate and suggestions are chosen
Every password you type gets two crack-time estimates side by side, both derived from the same zxcvbn guess count but applied to two different attacker speeds: how long it would take under an online attack throttled to 100 guesses per hour, and how long under an offline attack running 10 billion guesses per second against stolen password-hash data. Below those numbers, Password Strength Checker lists zxcvbn's own warning line, if it has one, followed by every one of its suggestion strings as separate bullet points - the exact wording the library produces for that specific password, not a generic "add more characters" tip. A password that already scores well can show an empty suggestion list, since there is nothing left for the library to flag.
Frequently Asked Questions
What does Password Strength Checker do?
Check how strong a password is before you use it - a 0 to 4 score, an estimated crack time, and specific suggestions.
When should I reach for password strength checker?
The score comes from zxcvbn, the same pattern-matching + dictionary-attack model used by Dropbox, not a simple length/character-class rule - it flags common passwords and predictable patterns that "P@ssw0rd1" style rules miss.
What complementary tools work well alongside password strength checker?
This tool does not store or recover passwords; it only scores whatever is currently typed into the field.
Does the strength bar load with the rest of the page, or wait for me to type first?
The tool renders a real score for the sample password immediately after the page loads - it does not wait for you to press a key first. That immediate render is what pulls in the scoring library the first time, so there can be a brief "Loading the local scoring library..." message before the very first score appears.
Why does the strength bar change color as I type?
The bar fills in five fixed-width steps - 20% per score point from 0 to 4 - and each step has its own color: red, deep orange, amber, light green, and green, matching the Very weak through Very strong label next to it.
What happens if I delete everything in the password field?
The bar, the label, the crack-time line, and the suggestion list all reset to blank as soon as the field is empty - the tool does not leave the previous password's score sitting on screen.
What if the scoring library can't load, for example over a bad connection?
The status line changes to "Could not load the local scoring library. Try reloading the page." instead of leaving the strength bar frozen with no explanation.
Does the tool re-download the scoring library every time I edit the password?
No - the library is fetched once per page visit and cached in memory; editing, clearing, or retyping the password afterward reuses the already-loaded copy instead of triggering another download.