Support: Password Strength Checker

Tell us what happened. Include which page you were on and what you expected to see. Most answers go out within a business day.

Common questions

Is it safe to type my password here?

The check runs inside your browser: the password is never sent to us, never stored, and not even counted. You can disconnect from the internet after the page loads and it still works. Even so, the safest habit is to test a password of the same pattern rather than one you already use, and to change any password a checker rates as weak.

How is the time to crack worked out?

The password is broken into the pieces an attacker would recognise: common passwords, dictionary words, names, keyboard runs, dates and repeats. Each piece costs a certain number of guesses, and the total is divided by the speed of four attacks, from a website that allows about 100 tries an hour to a cracking rig doing ten billion guesses a second against a stolen list.

Why is Pa55word! rated weak when it has a capital, a number and a symbol?

Because guessing programs try those tricks first. They know the common passwords, and they try look-alike swaps such as 5 for s and @ for a, a capital at the start and a symbol at the end. Length and unpredictability matter far more than which character types you use.

How long should a password be?

The US National Institute of Standards and Technology says verifiers shall require passwords used on their own to be at least 15 characters, should allow at least 64, and shall not impose rules about mixing character types or force regular changes. Four or five random words make a long password that is easy to type and hard to guess.

Does it check whether my password was in a data breach?

No. Checking that means sending part of your password's fingerprint to another company, and this tool sends nothing at all. It does recognise passwords that appear on the well-known lists of common and leaked passwords, which covers the ones attackers try first.

What do the five bars mean?

They follow the number of guesses needed: very weak is under a thousand, weak under a million, fair under a hundred million, strong under ten billion, and very strong above that. Aim for the top two for anything that matters.

Should I change my passwords every few months?

Current guidance says no: regular changes push people towards small, predictable edits. Change a password when there is a reason, such as a breach at that service, or a weak password like the ones flagged here.

Is it free?

Yes, completely free, with no sign-up and no limit.