How this password strength checker actually works
Most password meters you'll find online score based on arbitrary rules — "add a number," "add a symbol" — which allows weak-but-technically-compliant passwords like P@ssw0rd1 to score as "strong." This tool instead uses zxcvbn-ts, a pattern-matching password strength estimator: it checks your password against built-in password and language dictionaries, keyboard-adjacency patterns (like qwerty or 1qaz2wsx), dates, repeated and sequential characters, and common letter-for-symbol substitutions (like @ for a). The score (0–4) reflects how many guesses an attacker would realistically need, not just how many character types you used.
A long password can still be weak when it consists of repeated characters, common words, or predictable sequences — and a somewhat shorter but genuinely unpredictable password may require far more guesses to crack. Character categories alone do not determine the score: P@ssw0rd1 uses uppercase, lowercase, a digit, and a symbol, and still scores only 1 out of 4. The bar and crack-time estimate update as you type (after a short pause, to avoid recalculating on every keystroke), so you can see the effect of edits without needing to submit anything.
Why the breach check matters more than strength alone
A password can score well on pattern-matching and still be a bad choice if it has already leaked in a data breach — attackers don't need to guess a password that's sitting in a breach compilation they already own. This is a separate check from the strength score above: the strength score comes from a local, offline pattern-matching library with its own built-in word lists, while the breach check queries Have I Been Pwned's Pwned Passwords database, an independent, continuously updated collection of passwords seen in real breaches. This tool checks your password against it using k-anonymity: your password is hashed with SHA-1 locally in your browser, and only the first 5 characters of that hash are sent to the API. The full list of matching hash suffixes comes back, and the match is found locally — the complete password, and the complete hash, never leave your device.
Frequently asked questions
Do you store or log the passwords I type here?
No. Your password value itself is processed entirely in your browser and is never included in a network request during strength analysis — the first time you use this tool, your browser does fetch the (password-free) analysis code itself, same as loading any other part of the page. The breach check sends only a 5-character hash prefix; that prefix doesn't uniquely identify your password and is shared by many different hashes, though it isn't a mathematical impossibility to work backward from a hash if an attacker already has a list of candidate passwords to check against it — the point of the k-anonymity approach is that the prefix alone gives an observer very little to go on.
My password scored "Very hard to guess" but shows a crack time of seconds. Isn't that a contradiction?
No — they're answering different questions. The score measures how predictable the password is against pattern-based guessing (dictionary words, keyboard walks, dates, and so on); it doesn't know how the password will actually be stored. The crack-time rows answer "how fast, assuming a specific attack" — and a fast, unsalted hash can turn even a hard-to-guess password into a fast crack. That's precisely why we show four scenarios instead of one number: the honest answer depends on the attacker's method, not just your password.
What counts as a "strong" password?
A higher score means the password is harder to guess using known patterns — it is not a promise about how long it would survive an actual attack. That depends entirely on how the site storing your password hashes it: the same password can take centuries against a slow, properly-salted hash and seconds against a fast one, which is why we show multiple attack scenarios instead of a single number. Length and unpredictability still help in every scenario — a long passphrase of unrelated words generally scores higher than a short password stuffed with symbols in predictable places.
My password shows as strong but was found in a breach. Which matters more?
The breach result. A leaked password is a known password to attackers regardless of its theoretical strength — treat any "found in breaches" result as a password to retire immediately.
Does this catch things like "P@ssw0rd" or "Password123"?
Yes. zxcvbn-ts recognizes common letter-for-symbol substitutions (@ for a, 0 for o), dictionary words, and predictable suffixes like adding a number or capital letter — passwords built this way score low even though they'd pass most sites' "must contain a symbol and a number" rules.
What is k-anonymity, in plain terms?
It's a way to check a large dataset for a match without revealing what you're checking. Instead of sending your full password hash, only the first 5 characters are sent — thousands of other hashes share that same prefix, so the API can't isolate yours from the crowd. The exact match is found locally, on your device.
If you need a replacement for a weak or exposed password, create one with our cryptographically secure Password Generator.
Last reviewed: . Methodology: local zxcvbn-ts pattern analysis and an optional Have I Been Pwned k-anonymity lookup.