Password Strength Checker
See How Long It Would Take a Computer to Crack Yours

A Brute Force Attack is the most straightforward method an attacker uses to crack a password. The concept is simple: a computer program systematically tries every possible combination of characters - letters, numbers, symbols - until it finds the one that matches your password. Think of it like trying every possible combination on a combination lock, except a modern computer can test billions of combinations per second.

The attack has no intelligence or strategy behind it. It starts with "a", then "b", then "aa", "ab", "ac"... and keeps going until it succeeds or exhausts all possibilities. The critical insight is that this attack is defeated almost entirely by length. A password of 8 characters has around 200 billion possible combinations. A 12-character password has around 95 trillion - a difference so enormous that even the fastest supercomputers cannot crack it in a human lifetime.

This is why the "Time to Crack" estimate shown above changes so dramatically as you add just a few extra characters. Each additional character multiplies the total search space by the size of your character set (roughly 26 to 95x harder per character).

A Dictionary Attack is far smarter and faster than a brute force attack. Instead of trying random character combinations, it works from a pre-built list - a "dictionary" - of known passwords, common words, names, phrases, sports teams, movie titles, and every word from multiple human languages.

These dictionaries contain hundreds of millions to billions of entries compiled from real data breaches. When a major website is hacked and its password database stolen, those passwords are analyzed and fed into new dictionaries used by attackers worldwide. If your password is "password123", "iloveyou", "sunshine", or your pet's name, it is almost certainly in these lists and will be cracked in seconds.

Modern dictionary attacks also use "rules" - automated transformations like replacing letters with numbers (a becomes 4, e becomes 3), capitalizing the first letter, or adding a number at the end. This is why "P4ssw0rd!" is just as weak as "Password" to a modern attack tool. The zxcvbn library that powers this checker is specifically designed to detect these exact patterns and penalize them in the strength score.

This is one of the most important and misunderstood concepts in cybersecurity. Many websites and IT departments force users to create "complex" passwords with uppercase letters, numbers, and symbols. But research from NIST (the National Institute of Standards and Technology) and countless security experts shows that length matters far more than complexity.

Here is the math. Adding a symbol requirement expands your character set from roughly 62 characters (letters and numbers) to 95 characters - a modest 53% increase in difficulty per character. But adding a single additional character multiplies the total search space by the entire character set size (53x to 95x). Adding 5 extra characters is literally billions of times more effective than swapping a letter for a symbol.

Compare the passwords in the table below. The short, complex password is far weaker than the long, simple passphrase - even though it looks more "technical":

The passphrase is also dramatically easier to remember. This principle is behind the modern recommendation: use a passphrase of four or more random common words. The randomness and length work together to create a password that is both practically uncrackable and human-memorable.

Entropy is a concept borrowed from information theory. In the context of passwords, it is a single number (measured in "bits") that represents how unpredictable - and therefore how resistant to guessing - your password is. Higher entropy means a harder password.

Technically, entropy is calculated as: log2(N^L), where N is the size of the character set you used and L is the length of the password. A password drawn from 95 possible characters (all keyboard characters) that is 10 characters long has roughly 65 bits of entropy. Each additional bit of entropy doubles the number of guesses required to crack it.

In practice, security experts consider 50-60 bits of entropy the minimum for a reasonably secure password, and 80+ bits for a strong one. However, raw entropy calculations assume your password is truly random. If you use a dictionary word, a keyboard pattern (like "qwerty"), or a predictable substitution, the effective entropy drops dramatically - which is why the zxcvbn algorithm models realistic attacker strategies rather than just counting character types.

This is exactly the right question to ask before using any password tool - and the answer here is clear. This tool uses a technique called Client-Side Processing, which means every single calculation happens inside your own web browser on your own device. No server receives or stores your input.

Client-Side Processing means: your browser downloads the HTML page and the zxcvbn JavaScript library once, and then everything runs locally - the same way a calculator app on your phone works without an internet connection. When you type into the input field, the characters are analyzed by code running on your own CPU and are never packaged into a network request.

You can verify this yourself. Open your browser's developer tools (press F12), click the "Network" tab, then type a password into the field. You will see zero outgoing network requests associated with your keystrokes. The source code of this page is also fully readable in the "Sources" tab, confirming there are no hidden tracking scripts. This privacy-by-design architecture is what makes it safe to test real passwords here - but as a general principle, you should never type a password you actually use into any website unless you have verified it operates this way.

Pattern Matching is a technique used both by attackers and by password analysis tools (like this one) to identify predictable structures in a password. Attackers use pattern matching to dramatically reduce the search space they need to brute-force. Analysts use it to warn users when their "creative" password is actually highly predictable.

Common patterns that attackers exploit include: keyboard walks (sequences typed by sliding your fingers across the keyboard, like "qwerty", "12345", or "zxcvbn"), date patterns ("june2024", "19901231"), repeated characters ("aaaaaa"), common words with symbol substitutions ("p@ssw0rd"), and sequences based on personal information (names, birthdays, sports teams).

The zxcvbn library - named after one of the most common keyboard-walk passwords - was built by Dropbox security engineers specifically to detect all of these patterns. It models the attacker's point of view and calculates how many guesses a sophisticated attacker would realistically need, rather than relying on simple character-count rules. This gives a far more accurate picture of real-world security than a basic "strong / medium / weak" label.