Password Strength Checker

When to use it

Use this tool to find out how hard a password would be to guess, and why. Instead of only counting capitals and symbols, it looks for the patterns attackers really try first, such as common passwords, dictionary words, names, years and keyboard runs. It then gives plain advice to make the password stronger.

How to use it

1. Type a password in Password to check. The result updates as you type.
2. Read the rating, from very weak to very strong, and the estimated number of guesses.
3. Check the three time estimates:
   • If a website’s password list leaks (well protected)
   • If it leaks (poorly protected, fast hardware)
   • Guessing on a login page (rate limited)
4. Look at What an attacker would notice, which splits the password into the parts that are easy or hard to guess.
5. Follow the tips, and check the list of length and character types at the bottom.

If you need a new password, use the Password Generator.

Worked example

Type Summer2024! and the tool rates it weak, at about 10^7 guesses. If a site’s password list leaked, it could be cracked in about 3 minutes, or instantly with poor protection. The breakdown shows a common password and a year, which are among the first things attackers try. The tips suggest making it longer or using a passphrase.

Now try four random words, such as maple rocket quiet harbor. It is rated very strong, with more than 100,000 years in every situation. It is also easier to remember. Do not use either example as your real password, since both are now published here.

Tips

• Length beats complexity. Each extra random word or character multiplies the work for an attacker.
• Pick truly random words. Song lyrics, quotes and famous phrases are in attackers’ lists.
• Never reuse passwords. A leak on one site is then only a problem for that site.
• Let a password manager do the work. It can create and remember a long, unique password for every account, so you only need to remember one strong passphrase.

How the estimate works

The tool counts how many guesses an attacker would need if they tried the most likely passwords first. It then turns that number into time, using typical guessing speeds for each situation. Real attacks vary, so treat the times as a guide, not a promise.

Common mistakes

• Adding 1 or ! to the end. Attackers try these endings first.
• Using personal details. Birthdays, pet names and teams are easy to find on social media.
• Swapping letters for numbers. P@ssw0rd is still one of the most guessed passwords.