Test a password
Not the usual coloured bar. This tool shows the gap between what a password looks like it is worth and what it actually costs to break, and names the patterns that create that gap.
Try with:
Why does a password look stronger than it is?
The usual calculation multiplies the length by the size of the alphabet. On that basis, Password123! is worth 79 bits, which would take centuries. In reality it falls instantly, because no attacker draws characters at random.
They start with the passwords already seen in breaches, then dictionary words, first names, dates, keyboard runs, then the obvious substitutions: a for @, e for 3, o for 0. A password built out of those bricks costs only what it costs to find the bricks. That is what this tool measures.
Why four attacker profiles?
Because the same password does not resist the same way depending on where it is attacked. On a login form that limits attempts, almost anything holds. In a stolen database hashed with MD5, a machine tests a thousand billion combinations a second. That last column is the one to look at, because you do not choose how the site that holds your password stores it.
What actually makes a password strong
- Length before anything else: each extra character multiplies the cost, while a symbol added to a known word changes almost nothing.
- Several unrelated words, drawn at random rather than chosen: this is what makes a passphrase both memorable and expensive to break.
- A different password on every site, which only a password manager makes possible.
- Two-factor authentication, which keeps a leaked password from being enough on its own.
Frequently asked questions
Is my password sent somewhere when I test it?
No. Everything is computed in your browser, in memory. Nothing is sent to our server or to a third party, nothing is stored, nothing is logged. You can cut your connection: the tool still works.
Why does this tool give a lower figure than others?
Because most strength meters only count length and character variety. This one also looks for the patterns an attacker tries first: known passwords, dictionary words, first names, dates, keyboard runs and letter substitutions. It shows both figures so you can see the gap.
Is a password with a capital, a digit and a symbol strong?
Not necessarily. Password123! has all three and falls instantly, because it is a dictionary word followed by a predictable sequence. Length and unpredictability matter far more than composition rules.
How long should a password be?
Long enough to hold in the last column, the stolen database hashed fast. In practice that means several unrelated words drawn at random, or a manager-generated password of at least sixteen characters.
Does this tool tell me whether my password has leaked?
No, that is a different check. The leak test compares a fragment of your password's fingerprint against the Have I Been Pwned database, without transmitting the password itself. It has its own page.
Other tools
Don't miss the next analysis