Loading…
Loading…
Check how strong a password really is: estimated crack times, the words and patterns that make it guessable, and tips to improve it. Never leaves your browser.
Also covers: Password entropy calculator · How secure is my password · Password crack time
Passwords built from details about you are guessed first in targeted attacks. These words stay on this page too.
Loading dictionaries…
Everything runs in your browser — nothing you type or generate is sent anywhere. It isn't checked against breach databases — that would mean sending it (or part of its hash) to another service.
Results
Enter a password to see how long it would take to crack, which patterns make it guessable, and how to make it stronger.
It's checked on this page as you type, against common passwords, names, words, keyboard patterns, dates, and look-alike substitutions like P@ssw0rd.
See the score, how long attacks would take, which parts are guessable, and specific suggestions. Add personal words (name, pet, city) to see if the password relies on them.
The zxcvbn algorithm (originally from Dropbox) estimates how many guesses an attacker would need, trying common passwords and patterns first. That number is divided by attack speeds, from 100 guesses an hour against a rate-limited login to 10 billion a second against a stolen, fast-hashed database.
Swapping letters for look-alike symbols is one of the first tricks attackers apply. Length and randomness matter far more than symbols.
The check runs entirely in your browser and nothing is sent anywhere. Even so, it's good practice to check a similar password rather than one you actually use.
No. Breach checks need to query an online database, which this tool doesn't do. If you suspect a leak, change the password.
Passwords
Generate strong random passwords in your browser: choose length and character types, skip look-alike characters, and make up to 500 at once.
Passwords
Generate strong, memorable passphrases from the EFF's 7,776-word list, picked with secure randomness. Choose word count, separators, and capitals.
Passwords
Generate random 4, 6, or 8-digit PINs that skip easy guesses like 1234, 1111, years, and dates. Secure randomness, generated in your browser.
Keys
Generate random strings, API keys, and secret keys: pick the length and characters (hex, Base64url, alphanumeric, custom) or a key size in bytes. Cryptographically secure.
2FA
Get live 2FA codes from a TOTP secret or otpauth:// link, check a code, or create a new secret with a QR code for authenticator apps. RFC 6238.
Hash
Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE, and CRC32 hashes of text as you type, create HMAC signatures, and check a hash for a match.