Password Strength Checker & Leak Test
About the Password Strength Checker
Type a password to see how strong it really is — not just whether it has a symbol in it. The checker looks for the things attackers try first: common passwords, everyday words (even with letters swapped for @ or 0), keyboard patterns like “qwerty”, sequences, repeats and years, and estimates how long it would take to crack. You can also check, privately, whether the password has appeared in a known data breach.
Strength is checked in your browser. The optional leak check sends only the first 5 characters of a SHA-1 hash of your password to Have I Been Pwned, and only when you press the button.
How to use it
- Type or paste a password. The strength meter and crack-time estimates update as you type.
- Read the warnings and suggestions to see what makes it weak.
- Press “Check for leaks” to see whether it appears in known data breaches.
Frequently asked questions
Is it safe to type my real password here?
The strength check runs entirely in your browser and nothing is stored. For the leak check, only the first 5 characters of a SHA-1 fingerprint of your password are sent to Have I Been Pwned — never the password or its full fingerprint — and the matching happens on your device. If you prefer, test a similar password instead of your real one.
Why is “P@ssw0rd2024!” rated weak?
Because cracking tools try common words with predictable swaps (a→@, o→0), add years and a symbol at the end. Those tricks add almost no protection. Length and unpredictability matter far more.
What do the two crack times mean?
The first assumes a website’s password database was stolen and attackers guess offline at 10 billion guesses per second. The second assumes they can only guess at a login page, around 10 guesses per second. Both are estimates.
What makes a strong password?
At least 12–16 characters, not based on words, names or patterns, and different for every site. A passphrase of 4–5 random words is strong and easy to remember. A password manager makes this painless.