What Is a Password Strength Checker?
A password strength checker analyzes your password to determine how resistant it is to cracking attempts. Unlike simple checkers that only count character types, this tool uses the zxcvbn algorithm developed by Dropbox, which evaluates passwords the way real attackers would — detecting common words, keyboard patterns, repeated characters, and predictable substitutions.
How Strength Is Measured
This tool provides multiple metrics to give you a complete picture of your password security:
Strength Score
Entropy
Crack Time Estimates
Character Composition
How to Use the Password Strength Checker
Enter Your Password
Type your password in the input field — analysis starts immediately as you type, providing real-time feedback.
Review the Strength Meter
The colored bar shows your password's overall strength from Very Weak (red) to Very Strong (green).
Check the Score Cards
View your password's score percentage, entropy in bits, and estimated number of guesses needed to crack it.
Examine Crack Times
See how long it would take to crack your password under three different attack scenarios.
Read Warnings and Suggestions
Follow the actionable tips to improve your password's strength and eliminate vulnerabilities.
Understanding Crack Time Scenarios
Online Attack
Simulates a rate-limited attack typical of web login forms with throttling.
- 100 attempts per hour
- Standard web protection
- Slowest attack method
Offline Attack
Simulates fast hash cracking as if an attacker obtained a leaked password database.
- 10 billion guesses/second
- Leaked database scenario
- High-speed cracking
GPU Cluster
Simulates a massive GPU array representing a well-funded attacker with dedicated hardware.
- 100 billion guesses/second
- Advanced hardware setup
- Maximum threat level
Tips for Creating Strong Passwords
- Use 14 or more characters — length is the most important factor in password strength
- Mix all character types — uppercase, lowercase, numbers, and symbols for maximum complexity
- Avoid common words and patterns — dictionary words, keyboard sequences (qwerty), and personal information
- Consider using a passphrase — a sequence of random words is both strong and memorable
Password123!
- Common dictionary word
- Predictable number sequence
- Cracked in seconds
- Low entropy
Tr0p!c@l-M00n$et-7#Blaze
- Random word combination
- Mixed character types
- Years to crack
- High entropy
Features
Real-Time Analysis
zxcvbn-Powered Scoring
Multiple Attack Scenarios
Character Composition Breakdown
Actionable Feedback
Your Data Stays Private
Security & Privacy Details
- No uploads — Your password never leaves your device
- No tracking — We don't collect or store any passwords
- No network requests — The analysis library loads once, then everything runs locally
Frequently Asked Questions
Is it safe to type my real password here?
Yes, it's completely safe. All analysis is performed entirely in your browser using JavaScript. Your password is never sent to any server or stored anywhere. You can verify this by checking your browser's network tab — no requests are made after the initial page load.
What is entropy and why does it matter?
Entropy measures the randomness of your password in bits. A password with 40 bits of entropy has 2^40 (about 1 trillion) possible combinations. Higher entropy means more possible combinations an attacker would need to try, making your password harder to crack.
Example: A password with 60 bits of entropy has over 1 quintillion possible combinations, while one with 30 bits has only about 1 billion.
Why does my password score low even though it has special characters?
The zxcvbn algorithm looks beyond simple character requirements. Common substitutions (like @ for a, or 0 for o), dictionary words, keyboard patterns, and sequences are all penalized because real attackers check these first.
What is a good password strength score?
Aim for at least 75% (Strong). For sensitive accounts like email, banking, or password managers, aim for 100% (Very Strong).
The crack time for offline attacks should ideally be years or more for adequate protection.
How accurate are the crack time estimates?
The estimates are based on current computing capabilities and assume brute-force or intelligent dictionary attacks. Actual crack times may vary depending on:
- The hashing algorithm used by the service
- Available hardware and computing power
- Attack methods and techniques employed
- Security measures like rate limiting
The estimates provide a useful relative comparison between passwords to help you understand which are stronger.
What makes the zxcvbn algorithm different from other checkers?
Most password checkers only verify minimum requirements (length, character types). zxcvbn, developed by Dropbox, uses pattern matching to detect:
- Common passwords from breach databases
- Dictionary words in multiple languages
- Spatial keyboard patterns (qwerty, asdf)
- Repeated characters and sequences
- Date sequences and common substitutions
zxcvbn evaluates passwords the way real attackers approach cracking them, making it far more realistic than simple rule-based checkers.
— Dropbox Security Team
No comments yet. Be the first to comment!