Password Strength Checker

“Must contain a capital letter, a digit and a symbol” is the rule most sites show, and it is a poor measure of strength. Password1! passes it and falls within seconds, while purple tractor vanish seven fails it and would take centuries. What matters is how many guesses a clever attacker would need, and that depends on patterns. This page estimates exactly that, by working out the cheapest way to build your password from things people commonly use.

How the estimate is made

The checker splits the password into pieces and gives each piece the price an attacker would pay to guess it. A word from the top of the common-passwords list costs a handful of guesses. An ordinary dictionary word costs its rank in the word list, with extra for capital letters and for leet-style substitutions such as 0 for o. A keyboard run like qwerty, a repeat like aaaa, a sequence like abcd and a year or date each have their own cost. Anything left over is charged as random characters at the size of the character set used. The cheapest split is the estimate, in the spirit of the open-source zxcvbn library.

A worked example

Press Sample to test Summer2024!. It is 11 characters with an uppercase letter, digits and a symbol, so a rules checker would be happy. The page finds three pieces: “Summer” is one of the most common passwords, “2024” is a recent year, and “!” is a character with no pattern. Together they need about 2 to the power 26.6 guesses, roughly one hundred million, and the rating is Fair. The table then shows what that means: a rate-limited online attack of 100 guesses per hour would take about a century, an unlimited online attack at 10 per second about 120 days, an offline attack on a slow hash like bcrypt at 10,000 per second about 3 hours, and an offline attack on a fast hash on graphics cards less than a second. The advice lists the same problems: use at least 12 characters, avoid a very common password, avoid dates.

Reading the four attacks

Online attacks go through a login page, and servers can block them, so the table shows a rate-limited case and a stubborn one. Offline attacks happen after a database leak, when the attacker can try guesses as fast as hardware allows; that is where the storage method matters, and why the page distinguishes slow hashes from fast ones. A password only has to resist the scenario that fits where it is used.

Improving a password

Add length first. Four or five unrelated words, or a passphrase from the Diceware generator, beat symbols. Avoid names, years and keyboard patterns. Use a different password for each account and keep them in a password manager. Where it is offered, add a second factor.

Limits

The dictionary has about 3,000 common English words and a short list of well-known passwords, so unusual names, other languages and passwords from breaches are not recognised, and the result can be too optimistic. The attack speeds are round figures to compare options, not predictions. Treat the rating as a guide, and test a similar password rather than the real one.

Related tools

• Diceware Passphrase Generator creates passphrases of known entropy.
• Password Generator makes random passwords.
• Bcrypt Hash Generator shows the slow hashing that limits offline guessing.
• Hash Identifier helps you see how a leaked password was stored.