How it estimates strength
Rules like “one capital, one digit, one symbol” are poor predictors of real strength. This checker uses zxcvbn-ts, an open-source estimator based on Dropbox’s zxcvbn research. It looks for patterns attackers actually try first: common passwords, dictionary words, names, keyboard walks like qwerty, dates, repeats and simple substitutions like p@ssw0rd.
It reports a score from 0 to 4 and estimated guessing times for two scenarios:
- Offline, slow hash: an attacker who stole a well-protected password database (bcrypt/scrypt/Argon2-class hashing).
- Online: an attacker guessing against a live login with no rate limit.
Privacy
The estimator runs in your browser and loads only from our domain. Your password is never sent anywhere, and nothing is logged. Still, avoid typing a password you actually use for important accounts into any website.
Limitations
- Estimates are heuristic. A password that looks random but was reused or leaked in a breach is weak no matter what the meter says.
- The built-in dictionaries are mainly English. Words from Turkish or Persian may score higher than they deserve.
- For new passwords, a random generator plus a password manager beats anything you can invent.