Password Strength Checker

How to Use the Password Strength Checker

1. 1. Type or paste a password. It stays on your device: the page compares it with word lists it has already downloaded, and nothing is sent, saved or logged. Use Show to check what you typed.
2. 2. Read the verdict. The rating says which of four attacks the password would hold out against for at least a year, from throttled online guessing to fast offline cracking.
3. 3. See what gave it away. What the estimate found splits the password into the pieces an attacker would guess — common passwords, words, names, dates, keyboard runs — with the guesses each one costs.
4. 4. Fix it or replace it. Follow the suggestions, or make a new password with the Password Generator and check that one.

How the Estimate Works

Most meters multiply the length by the bits per character. A password of length L drawn from a pool of N possible characters has L × log₂ N bits of character-set entropy — 26 letters for lower case alone, 95 for all the printable ASCII characters. That is the right figure for a password picked at random: 16 random characters from all 95 give about 105 bits. But people do not pick at random, and attackers know it.

So the checker also guesses the way a cracker does. It finds every common password, English word, first name, surname, l33t spelling, reversed word, sequence (abc, 2468), repeat, keyboard walk (qwerty, 1qaz2wsx), year and date inside the password and prices each piece by the guesses needed to reach it — a word's rank on its list, times the ways its capitals and swaps could have been chosen. Letters that read like English but are on no list are priced by a letter-pair (Markov) model, as Markov-mode crackers guess them; anything left is random characters. The cheapest way to cover the whole password is the estimate: the method of Dropbox's zxcvbn (Daniel Lowe Wheeler, USENIX Security 2016), with smaller lists.

P@ssw0rd! looks complex, but it is password — the second entry on the common-password list — with three of the first changes any cracker tries. At 10 guesses a second it falls in about 33 minutes; against a stolen database protected by a slow hash, in about 2 seconds.

What the Crack Times Assume

• Online, throttled — 100 guesses an hour. A site that slows down or locks an account after failed logins.
• Online, not throttled — 10 a second. A login with no limit on attempts.
• Stolen database, slow hash — 10,000 a second. The site stored its passwords with bcrypt, scrypt or Argon2, which are deliberately expensive to compute.
• Stolen database, fast hash — 100 billion a second. Unsalted MD5 on one current high-end graphics card. Large cracking rigs go faster still.

The rating counts how many of these attacks the password would survive for at least a year: very weak falls even to throttled guessing, very strong holds out against fast offline cracking. Real attackers' lists run to millions of entries, far longer than this page's, so read a good result as a best case, not a guarantee.

What Makes a Strong Password

• Length beats complexity. NIST's current guidance, SP 800-63B-4 (2025), requires at least 15 characters for a password used on its own, asks services to accept at least 64, and drops rules such as "one digit and one symbol".
• Random beats clever. Look-alike swaps, a capital at the start and a digit or ! at the end are the first variations crackers try.
• One password per account. A reused password is only as safe as the weakest site that stores it.
• Let a password manager do the work. It can generate and remember a long random password for every account; for the few you type, use four or more randomly chosen words.

The lists the password is compared with: the 5,000 most common passwords in Mark Burnett's sample of ten million, which he released to the public domain, as ranked in SecLists (MIT licence); the 8,000 commonest English words in 70 public-domain books from Project Gutenberg; and first names and surnames from the US Census Bureau's 1990 lists.

Frequently Asked Questions

Is it safe to type my password into a password strength checker?

This one runs entirely in your browser: the word lists download with the page, the password is compared with them on your device, and it is never sent to CitationEasy or anyone else, stored or logged. Still, it is good practice not to type a password you really use into any website. Check one built the same way instead — same length, same kinds of words and characters.

What is password entropy?

A measure, in bits, of how many guesses a password would take if every character were chosen at random: length × log₂(number of possible characters). Each extra bit doubles the guesses. It overstates the strength of anything a person chose, which is why the checker also gives a pattern-aware estimate — the figure to trust.

Why does my password with symbols score so low?

Because the symbols are in predictable places. P@ssw0rd! has 59 bits of character-set entropy, but crackers try common passwords first and apply the usual swaps — @ for a, 0 for o, a capital at the start, ! at the end — so it is reached after about 20,000 guesses. Length and randomness add strength; decoration does not.

How long should a password be?

At least 15 characters for a password used on its own, according to NIST SP 800-63B-4, and longer is better. A random 16-character password from a generator, or a passphrase of five or six random words, puts offline cracking out of reach. Length is worth more than mixing in symbols.

Are passphrases better than passwords?

A passphrase of randomly chosen words is easier to remember and type, and strong if the words really are random. Each word drawn from a list of 7,776, as in EFF's dice word list, adds about 12.9 bits, so six words give about 77.5 bits. A famous quotation or song lyric is not random and is weak.

Why does this checker give a different result from other meters?

Meters differ in their word lists and attack assumptions. Many only count character types, which rewards P@ssw0rd!; pattern-aware meters such as zxcvbn, and this one, look for what crackers try first. This checker uses smaller lists than a real attacker, so a password made of rare words or names it does not know may look stronger here than it is.