Password Strength Checker
Type a password to see how long it would take to crack, what makes it weak, and whether it has already leaked in a data breach.
Check a password
- 12+ characters
- Lowercase
- Uppercase
- Number
- Symbol
Your password is checked in your browser and never sent to us.
Has this password leaked?
Checks the password above against Have I Been Pwned's database of passwords exposed in data breaches. Only the first 5 characters of a scrambled (SHA-1) version are sent, never the password itself.
Has your email been in a data breach?
Have I Been Pwned is a free, widely trusted service run by security researcher Troy Hunt. Enter your email on their site to see which breaches it appears in.
Check your email on Have I Been PwnedHow this checker works
Most “strength meters” just count symbols and numbers. That's why Password1! often looks strong, even though it's one of the first things attackers try. This checker uses zxcvbn, an open-source estimator that thinks like a password cracker: it spots common passwords, names, dictionary words, dates, keyboard patterns like qwerty and swaps like @ for a.
The two crack times show two situations. A fast attack is what happens when a website stored passwords carelessly and they leak. Stored securely assumes the site used a slow, modern hashing method, which makes guessing far slower.
What makes a strong password?
- Length beats complexity. Four or five random words, like a passphrase, are stronger and easier to remember than a short jumble.
- Unique for every account. When one site leaks, criminals try the same password everywhere else.
- Nothing personal. Names, birthdays, pets and sports teams are easy to guess from social media.
The easiest way to have a unique, strong password everywhere is a password manager. You can also use our password generator, and turn on two-factor authentication so a leaked password alone isn't enough.
What if my password has leaked?
Stop using it everywhere, starting with your email and bank. Our guide to what to do after a data breach walks through the steps in order.
Frequently asked questions
Is it safe to type my real password here?
The strength check runs entirely in your browser, and nothing you type is sent to us or stored. If you'd rather not test a password you actually use, type something with the same length and style instead.
How does the leak check keep my password private?
Your browser turns the password into a SHA-1 hash and sends only its first 5 characters to Have I Been Pwned. The service returns all leaked hashes starting with those characters, and the match is checked on your device. This technique is called k-anonymity.
What is a good password length?
For important accounts, aim for at least 16 characters, or a passphrase of four or five random words. Length adds far more strength than swapping letters for symbols.
This tool gives an estimate based on common warning signs. It can't guarantee that something is safe. When in doubt, contact the company directly using a website or phone number you already trust.