Password Strength Checker

How the Checker Rates a Password

This password checker estimates how many guesses an attacker needs, then shows a strength rating and an estimated time to crack. It uses zxcvbn 4.4.2, a local pattern-matching estimator.

The method recognises common passwords and names. It also checks repeated groups, keyboard patterns, dates and familiar substitutions such as replacing a letter with a number. Extra character types alone do not make a predictable password strong.

The displayed time divides the estimated guesses by 10,000 guesses per second. This is zxcvbn's offline slow-hash scenario: an attacker has a stolen password hash and can test guesses without a login limit. A fast hash can allow far more guesses per second. A site's hashing method and the attacker's hardware change the result.

The public example, Password123!, rates Weak and shows 4 seconds. Never use this example for an account. The rating cannot detect a password built from personal details the estimator does not know, and a high score does not confirm that an account is safe.

Is It Safe to Test a Password Here?

The strength check runs in your browser. The checker sends no password to a server and saves no password in cookies or browser storage. The tool area is excluded from session recording. Clear password empties the field.

Use a made-up example if you only want to compare patterns. Keep your screen private when showing a password. Browser extensions or malware on your device can still read what you type.

A tester that sends a complete password to a server gives another system access to a secret. Use a checker that explains its local processing. HTTPS protects data in transit but does not stop the receiving server from seeing it.

Fix a Weak Password

Replace a weak password with a longer, unpredictable password that you use for one account only. Start with the email account that can reset your CRM and other business accounts.

1. Use a password manager to create and save a unique password. The related password generator can create a replacement in your browser.
2. For a password you must remember, use unrelated randomly chosen words. Aim for at least 15 characters under the Australian Cyber Security Centre's password guidance. Avoid quotations, client names and brokerage names.
3. Save the replacement through the account's own security settings. Changing a sample here does not change any account password.
4. Turn on two-factor authentication and keep its recovery codes somewhere protected.

The Australian Cyber Security Centre's password guidance explains password length, uniqueness and password managers. Follow the account provider's accepted length and character rules when saving a replacement.

Strength vs a Leaked Password

Strength describes resistance to guessing. Breach exposure means a password has appeared in stolen data. An attacker who already knows a leaked password can try it directly, even when a strength meter gives it a high score.

This tool performs no breach lookup. Use Have I Been Pwned's Pwned Passwords separately to check known breach data. That service hashes your entry locally and sends only a short hash prefix for its lookup.

A password absent from that database can still be compromised. If a password has leaked or you suspect someone has it, replace it wherever you reused it. Review the account's active sessions and recovery details too.