Free Password Strength Checker — Real-Time Security Analysis & Breach Detection

Strong passwords combine four things: length (12+ characters), character diversity (uppercase, lowercase, numbers, symbols), randomness (no dictionary words, names, or patterns), and uniqueness (never reused across sites). Example: "g7#Kx!mP2nQz" is strong — random, mixed character types, no patterns. "P@ssw0rd123" looks complex but is weak because it follows a predictable substitution pattern found in breach databases.

The table shows four real-world attack scenarios powered by zxcvbn: (1) Online rate-limited — a login form that locks out after too many attempts (100 guesses/hour); (2) Online unthrottled — an API or service with no rate limiting (10/sec); (3) Offline slow hash — an attacker who stole a database protected with bcrypt or scrypt (10,000/sec); (4) Offline fast hash — the worst case, a database using MD5 or SHA-1 with a GPU cluster (10 billion/sec). A password safe for a login form can be cracked in seconds in scenario 4.

No — your password is never transmitted. The tool uses the Have I Been Pwned k-anonymity API. It computes a SHA-1 hash of your password inside your browser, then sends only the first 5 characters of that hash (out of 40) to the HIBP API. HIBP returns all hashes that start with those 5 characters, and the comparison happens locally in your browser. This means HIBP never sees your password or its full hash.

Despite containing uppercase, a number, and a symbol, it matches a well-known pattern in breach databases. zxcvbn detects that "Password" is a dictionary word, "123" is a sequential run, and the trailing "!" is a predictable suffix. These patterns collapse the effective entropy dramatically. A strong password with the same length but randomness — e.g., "g7#Kx!mP2nQz" — would score Very Strong.

Entropy (measured in bits) quantifies how unpredictable a password is. Each additional bit of entropy doubles the number of guesses an attacker needs. A 40-bit password takes roughly 1 trillion guesses to crack — that sounds huge, but a modern GPU can test billions per second. NIST recommends at least 60–80 bits of entropy for sensitive accounts. Avoid patterns: a 20-character password full of repeated characters can have lower entropy than a random 12-character one.

Never. The strength analysis runs entirely in your browser using the zxcvbn JavaScript library. The breach check uses k-anonymity so only 5 hex characters of a hash are ever sent over the network. Your actual password is never sent to any server, never logged, and never stored anywhere.