Password Strength
Check a password against the way it would really be attacked — known passwords, keyboard runs, dates, words with digits on the end — and see how long it would survive. Nothing is sent anywhere.
What it does
Password Strength reads the whole document before doing anything, so what comes back is either valid output or a specific error with the position that caused it — not a partially rewritten file.
When you need it
Usually when something has already gone wrong: a config file an application will not load, an API response that has to be read by a human, or an export that has to be checked before it goes anywhere near a database.
Limits and caveats
Key order is preserved as it appears in the input. Very large documents are limited by your device's memory rather than by an upload cap, since the parsing happens locally. Everything happens in your browser, so the file never leaves your device.
How to password strength
- Type or paste the password.
- See what an attacker would try first.
- See how long it would take.
Frequently asked questions
- Is it safe to type my password here?
- It is safe here in a way it is not on other checkers: this page has no server to send it to. Every check runs in your browser, nothing is stored, and nothing is transmitted — you can turn off your network first and it still works. That said, the habit of typing a real password into a website is a bad one, and testing a close variant tells you the same thing.
- Why does it call Password123! terrible?
- Because it is. It is the single most predictable thing anyone types when a form demands a capital, a digit and a symbol, and it appears in the first few thousand guesses of any real attack. A meter that rewards the pattern teaches the pattern.
- What does the time mean?
- Guessing against a stolen database with a fast GPU — roughly ten billion guesses a second. That is the attack that actually happens: passwords leak in bulk and are cracked at leisure. Against a login form that rate-limits, every password looks strong, which is why that is not the number shown first.
- What can it not see?
- Your dog's name, your street, your birthday, and the fact that you used this password on another site that has already been breached. It is a floor on how bad a password is, never a promise about how good.
- Do my files get uploaded?
- No. This tool runs entirely in your browser, so the file never leaves your device.