Password Strength Checker

Diagnosing a Password You Already Have

1. Type or paste the password into the input box. Scoring runs on every keystroke; there is no "analyze" button. The pattern dictionaries load once on your first keystroke, which takes a moment on a slow connection.
2. Read the strength bar. It maps zxcvbn's 0-4 score: red (Very Weak) through orange, yellow, green, to deep green (Very Strong). A score of 3 or 4 is the target.
3. Check the length readout against the 15-character NIST single-factor floor. This is the one number worth optimising, because it is the only one an attacker cannot shortcut.
4. Read the findings. Each names a specific pattern the analyser matched and shows the offending substring: a known word, a keyboard walk, a repeat, a sequence, a date.
5. Rebuild rather than patch. Appending "!" to a flagged password changes almost nothing - the rule engines attackers use apply that transformation to every candidate for free.

What the Scoring Actually Inspects

The score comes from zxcvbn-ts, a maintained TypeScript port of Dropbox's zxcvbn. It searches for the cheapest way to describe your password: dictionary matches against common passwords, English words, first and last names and Wikipedia titles; l33t-substitution variants of those; keyboard adjacency walks; repeats; ascending and descending sequences; dates. It then multiplies out how many guesses that decomposition costs an attacker and reports the total. What it does not do is award points for containing an uppercase letter. The whole model is "how few guesses is this", which is the question an attacker is answering too.

Why This Changed

An earlier version of this tool scored the way most signup forms still do: a point each for lowercase, uppercase, digits and symbols, plus length tiers, and an entropy readout computed as length * log2(poolSize). That model rates P@ssw0rd1 at 59 bits and praises it for using all four character classes, while the same string sits in every cracking wordlist and falls in seconds. It also emitted the advice "Letters only (add numbers/symbols)" - the exact composition rule NIST SP 800-63B-4 tells verifiers they SHALL NOT impose. Both are gone. Length against the 15-character floor leads, guessing difficulty decides the score, and character-class advice is filtered out of the feedback before it reaches you.

When You Need a Diagnostic, Not a Generator

• Auditing an inherited password policy at a new job - paste the example passwords in the team documentation and see which ones are objectively weak.
• Coaching someone who keeps reusing a pet's name and a year, showing them live which part of it the analyser found and how little the year added.
• Deciding whether a password you memorised years ago is still worth keeping on a low-stakes account or should be retired to the vault.
• Testing whether a passphrase you built from memorable words reaches the strong band - it usually does, and seeing that is what breaks the "must have a symbol" habit.
• Showing a product manager why "must contain one special character" does not help, by comparing a 12-character complex password with a 20-character passphrase side by side.
• Checking a password suggested by someone else, or exported during a vault migration, for obvious red flags before adopting it.

What This Still Cannot Tell You

A high score means no pattern zxcvbn knows about matched. It does not mean the password is unbreached. NIST's blocklist requirement - "verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords" - is the check that catches a password with no visible structure that happens to be sitting in a dump, and no purely local tool can perform it against the full corpus. zxcvbn's common-password dictionary covers the well-known entries; the long tail needs haveibeenpwned.com/Passwords, whose range API is k-anonymous but is still a network call, which is why it is not wired in here. Unicode homoglyphs and personal facts an attacker might know about you (your employer, your street, your child's name) are also outside the model unless they happen to be in a dictionary.

What "Strong" Means Here

The bar maps zxcvbn's score, which is derived from the guess estimate: 0 is under 1,000 guesses, 1 under a million, 2 under a hundred million, 3 under ten billion, 4 above that. The crack-time readout translates the same number into wall-clock time under an offline attack against a fast hash at ten billion guesses per second. Against a properly tuned bcrypt or Argon2 the same password lasts far longer, but you rarely get to choose the server's hashing, so the fast figure is the honest one to plan against. For a machine-generated password, the guess estimate and charset entropy converge - there are no patterns to find, so brute force is the cheapest attack and the formula is finally the right one.