Password strength checker
Type a password to see how strong it really is. It is checked on this device and never sent or saved.
Password strength checker
Checked as you type, on this device. It isn't saved and is cleared when you leave.
Has this password leaked?
Tap Check to look it up in Have I Been Pwned's list of hundreds of millions of leaked passwords. Only the first 5 characters of its SHA-1 hash are sent, never the password.
Generator
Made on this device with your browser's secure random generator. Never saved, never sent, no history.
Options
Site rules PRO
Make a list PRO
Five rules for strong passwords
- Length beats tricks.Four or more random words, or 16+ random characters. Swapping a for @ adds almost nothing.
- One password per site.Reuse is how one leak opens every account.
- Let a password manager remember them.Your phone or browser has one built in.
- Turn on two-step sign-in.Use a passkey or an authenticator app where you can.
- Skip names, dates and patterns.Birthdays, pets, teams and qwerty are tried first.
Settings
What it does
The checker looks for what attackers try first: common passwords, dictionary words, names, years and dates, sequences like abc or 123, repeats and keyboard patterns like qwerty. It counts those as cheap guesses and estimates how many guesses the rest would take.
The estimate only knows the words in its lists, so a password built from other words can score higher than it should. Treat a good score as the best case, and remember that a strong password used on two sites is only as safe as the weaker site.
How to use it
- Type or paste a password in the box.
- Read the rating, the bits and the crack times, and the warnings under them.
- Weak? Use the generator below for a random one.
Passwords are made on this device and are never saved, sent or kept in a history. Only your settings are remembered.
Good for
- Checking an old password before you decide to keep it
- Seeing why "P@ssw0rd2024" is weak
- Teaching what makes a password strong
- Comparing a passphrase with a random password
Questions
Is it safe to type my password here?
The check runs on this device and works offline. Nothing you type is saved or sent, and it is cleared when you leave the page. The leak check only sends 5 characters of a hash, and only when you tap Check.
Why is my password rated weak when it has symbols?
Symbols swapped in for letters (@ for a, 0 for o) are among the first things attackers try. Length and true randomness matter much more.
More generators and checks
Open the full Password Generator · Guide: How to create a strong password