Password Strength
Check a password against the way it would really be attacked — known passwords, keyboard runs, dates, words with digits on the end — and see how long it would survive. Nothing is sent anywhere.
What it does
Password Strength uses the cryptography built into your browser (WebCrypto) — the same standard algorithms your bank's site uses — on a file or a piece of text that never leaves this page.
When you need it
Before sending something sensitive by email or chat, when a file you received must be checked, or when you want to know whether a password or a signature holds up.
Limits and caveats
A strong algorithm is only as safe as the password or certificate behind it, and some checks — whether a certificate was revoked, say — need the issuer's servers, which the page says where it matters. Nothing is stored or logged. Everything happens in your browser, so the file never leaves your device.
How to password strength
- Type or paste the password.
- See what an attacker would try first.
- See how long it would take.
Everything happens on this device: no file is uploaded and nothing leaves the browser.
Frequently asked questions
- Is it safe to type my password here?
- It is safe here in a way it is not on other checkers: this page has no server to send it to. Every check runs in your browser, nothing is stored, and nothing is transmitted — you can turn off your network first and it still works. That said, the habit of typing a real password into a website is a bad one, and testing a close variant tells you the same thing.
- Why does it call Password123! terrible?
- Because it is. It is the single most predictable thing anyone types when a form demands a capital, a digit and a symbol, and it appears in the first few thousand guesses of any real attack. A meter that rewards the pattern teaches the pattern.
- What does the time mean?
- Guessing against a stolen database with a fast GPU — roughly ten billion guesses a second. That is the attack that actually happens: passwords leak in bulk and are cracked at leisure. Against a login form that rate-limits, every password looks strong, which is why that is not the number shown first.
- What can it not see?
- Your dog's name, your street, your birthday, and the fact that you used this password on another site that has already been breached. It is a floor on how bad a password is, never a promise about how good.
- Do my files get uploaded?
- No. This tool runs entirely in your browser, so the file never leaves your device.