Password strength checker

What happens to what you type

It stays in this browser tab. The checker is a program that runs on your device, so there's no request to our servers or anyone else's with your password in it. We don't store it, and it's cleared when you leave the page.

Google Analytics and session recording are switched off on this page. Once the first rating appears, the checker has everything it needs, so you can turn off your internet connection and keep going. To check that nothing is sent, open your browser's developer tools and watch the Network tab while you type: you'll see only the checker itself download, the first time you click in the field. One thing we can't control: browser extensions you've installed can read any field on any page.

How to read the result

The rating comes from zxcvbn, an open-source password strength estimator created at Dropbox and described in a 2016 USENIX Security paper. Rather than counting symbols, it looks for what password crackers try first: common passwords, names, common English words, dates, repeats, sequences, keyboard patterns and letters swapped for symbols. Then it estimates how many guesses your password would take.

The times show what that estimate means at four assumed guessing speeds, from an online service that limits attempts to a stolen database protected by a fast hash. They aren't predictions. The checker also has limits worth knowing:

• It can't tell whether a password has already leaked. A password in a breach can be used without guessing at all.
• It's cautious about truly random strings. It multiplies its estimate by 10 for each unrecognized character, so a long random password from a password manager is stronger than the times suggest.
• Its estimates get rougher as they grow. The zxcvbn paper reports high accuracy only up to about 100,000 guesses, and that's with 1.5 MB of data; the version used here is about 400 KB. So treat large numbers and the top rating as rough.
• It doesn't know you. A word that means something to you, such as a pet's name or a street, can rate well here and still be easy for someone who knows you to guess.

What makes a password strong

• Length. CISA says at least 16 characters, and the FTC says to aim for at least 12.
• Randomness. CISA suggests a mix of upper and lowercase letters, numbers and symbols, or a passphrase of 5 to 7 unrelated words. The FTC says a passphrase should use random words.
• One password per account. CISA says each password should be used for only one account. That way, one breach doesn't open your other accounts.
• Not just symbols. NIST tells government services not to impose composition rules such as requiring symbols. Swapping letters for symbols doesn't help much: this checker rates P@ssw0rd1! as weak because it's so close to a common password.

Why a password manager helps

Nobody can remember a long, random, different password for every account, and a password manager doesn't ask you to. CISA and the FTC both point to one for creating and storing strong passwords. Our guide to password managers covers how to start without locking yourself out. Then add a second step at sign-in for your most important accounts with two-factor authentication.