Your files never leave your device. All processing happens locally in your browser.
How can I check how strong my password is without it being uploaded anywhere?
Open the Password Strength Checker and type or paste a password — it is analysed instantly and entirely in your browser, with no network request and deliberately no breach lookup. Instead of the misleading “alphabet⁵ˡᵉ₃ᵗʰ” entropy, the tool estimates how many GUESSES an optimal attacker needs: it finds the predictable patterns first — common passwords, dictionary words, keyboard walks like “qwerty”, sequences like “abc”/“123”, repeats, dates and l33t substitutions — then uses dynamic programming (the zxcvbn approach) to pick the cheapest way to crack it. You get a 0–4 score, entropy in bits, an estimated guess count, and crack-time ranges across five attacker models (from a rate-limited login to a trillion-guess-per-second cluster), plus specific feedback on what is weak.
Type or paste — analysed on-device, never uploaded, no breach / HIBP lookup
Reports entropy (bits), an estimated guess count and a 0–4 score
Crack-time ranges for five attacker models, with the assumed guess rate shown
Actionable feedback + a crypto-secure passphrase generator to try a strong secret
What is
password strength (estimation)
Password strength is an estimate of how hard a password is to guess, expressed as the number of guesses an attacker needs (often converted to “entropy” bits, the base‑2 logarithm of that guess count). A realistic estimate does not simply multiply the character‑set size by the length — that overstates human‑chosen passwords — but discounts predictable patterns such as dictionary words, common passwords, keyboard walks, sequences, repeats, dates and l33t substitutions, because attacker software tries those first. This tool computes that estimate 100% in the browser, with no breach‑database lookup.
No. It is analysed entirely in your browser, with no upload and deliberately no breach / HIBP lookup, so it stays private.
The Password Strength Checker is 100% client‑side. The dictionaries and the whole analysis ship inside the page, so your password is scored in local JavaScript with no network request, no upload and no logging. We deliberately do NOT run a breach / “Have I Been Pwned” check, because that would mean sending a hash of your password to a third party; keeping it private is the trade‑off we chose. The tool works offline once cached, keeps no history, and the only optional network use anywhere on the site is consent‑gated ads, which never see your password.
Length adds far more guessing work than swapping in a few symbols, and it is easier to remember.
Each extra character multiplies the number of possibilities an attacker must try, so length is the single biggest factor in strength — a point NIST’s SP 800‑63B guidance emphasises over forced complexity. A short password like “P@ssw0rd!” looks complex but is built from a common word plus predictable substitutions the attacker checks first, so it scores poorly here. Four to six random, unrelated words (a passphrase) reaches very high entropy while staying memorable. This tool includes a crypto‑secure passphrase generator that draws words using crypto.getRandomValues so you can try one.
It divides the estimated guess count by an assumed attacker guess rate, shown for five different scenarios.
The engine first estimates how many guesses an optimal attacker needs, then divides by a guesses‑per‑second rate for each of five models: a rate‑limited online login (≈100/s), an unthrottled online endpoint (≈10,000/s), an offline stolen database stored with a slow hash such as bcrypt or Argon2 (≈10,000/s), an offline database stored with a fast hash such as MD5/SHA‑1 cracked on a GPU (≈10 billion/s), and a well‑funded cluster (≈1 trillion/s). The assumption for each is shown on screen. Because how a site stored your password matters enormously, you should read the RANGE, not a single number.
Yes — the score is an estimate, and a strong-looking password can still be leaked, reused or personally predictable.
The score is an estimate in the spirit of zxcvbn, not a guarantee. Its bundled word lists are small, so a password built from an uncommon name or a word it does not list may score higher than it should. It also does no breach lookup, so a password can look “strong” here yet already sit in a leaked database — which makes it worthless. And it cannot know personal context: your pet’s name or address is random to the tool but obvious to someone who knows you. Treat the score as coaching. Real safety comes from a password manager, a unique password per account, and two‑factor authentication.
Detailed Explanation
📖How It Works
What the Password Strength Checker Does
The Password Strength Checker is a 100% client-side tool that estimates how hard a password is to guess and explains why. As you type or paste, it analyses the password entirely in the browser — no network request, no upload, and deliberately no breach / “Have I Been Pwned” lookup — and returns a 0–4 score with a live meter, the entropy in bits, an estimated attacker guess count, crack-time ranges across five attacker models, the specific predictable patterns it found, and actionable feedback. It exists because the everyday advice (“add a number and a symbol”) is misleading: attackers do not brute-force blindly, so this tool models how they actually guess. It also ships a crypto-secure passphrase generator so you can try a genuinely strong secret on the spot.
Scored on-device in real time — no upload, no server, no CDN, no breach lookup
Outputs a 0–4 score, entropy in bits, an estimated guess count and crack-time ranges
Lists the predictable patterns it found and gives targeted feedback
Includes a crypto.getRandomValues passphrase generator
The answer to “how strong is my password?” without leaking the password
⚙️Methodology
How the Estimate Works (Pattern-Aware, zxcvbn-style)
Rather than the naive “alphabet-size ^ length” entropy — which badly overstates human-chosen passwords — the engine (passwordStrengthEngine.ts) estimates the number of GUESSES an optimal attacker needs, following the approach of Dan Wheeler’s zxcvbn (USENIX Security 2016). It scans the password for overlapping predictable patterns: common passwords and dictionary words (from a bundled local list), reversed and l33t-substituted words, alphabetical/numeric sequences (abc, 6543), repeats (aaa, abcabc), keyboard walks (qwerty, asdfgh) and dates/years. Each pattern is assigned a guess cost, unmatched spans are charged a brute-force cost based on the character classes actually used, and a DYNAMIC-PROGRAMMING search finds the decomposition that MINIMISES total guesses (the path a smart attacker would take), including a factorial factor for the ordering of segments. That guess count becomes entropy bits via log₂ and a 0–4 score via standard thresholds.
Estimates attacker GUESSES, not blind alphabet^length entropy
Dynamic programming picks the cheapest (weakest) decomposition an attacker would use
Unmatched spans charged brute-force by the character classes present
Entropy bits = log₂(guesses); 0–4 score from guess-count thresholds
🔧Technical Details
The Five Crack-Time Scenarios
A single crack-time number is meaningless without stating the attacker, so the tool reports FIVE, each with its assumption shown. Online, rate-limited (≈100 guesses/sec) models a login form that throttles or locks out. Online, no throttling (≈10,000/sec) models an exposed endpoint. Offline, slow hash (≈10,000/sec) models a stolen database stored with bcrypt or Argon2 — a deliberately slow, memory-hard hash — which by design lands in the same order as an unthrottled online attack. Offline, fast hash (≈10 billion/sec) models a database stored with a fast, unsuitable hash like MD5 or SHA-1 cracked on a single modern GPU. Offline, massive cluster (≈1 trillion/sec) models a well-funded attacker with many GPUs/ASICs. Each scenario’s time is the estimated guess count divided by that rate; users are told to read the RANGE, because how the target site stored the password dominates the outcome.
Offline bcrypt/Argon2 slow hash ≈10,000/s — same order as unthrottled online, by design
Offline fast hash (MD5/SHA-1) ≈10 billion/s on one GPU
Offline massive cluster ≈1 trillion/s
Time = estimated guesses ÷ assumed rate; read the range, not one figure
⚠️Limitations
Honest Limitations
This is an ESTIMATE and a coaching aid, not a guarantee. The bundled word and password lists are small (a few hundred common passwords plus a compact English list), so a password built from an uncommon name or a word the tool does not list can score higher than it truly deserves — a real attacker uses corpora of billions. There is deliberately NO breach lookup, which is the privacy trade-off: a password can score “strong” here yet already sit in a leaked database, which makes it worthless regardless of entropy. Crack-time figures depend entirely on the assumed guess rate and on how the target site stored the password (a fast hash can be billions of times weaker than a slow one), so they are ranges, not promises. And the tool cannot know personal context — a pet’s name, a birthday or an address is random to it but obvious to someone who knows you. Treat the score as guidance; real safety comes from a password manager, a unique password per site, and two-factor authentication.
Small bundled dictionaries — an unlisted word/name can inflate the score
No breach lookup by design; a “strong” password may already be leaked
Crack times are ranges that depend on the site’s password storage
Cannot know personal context (names, dates, addresses)
An aid, not a guarantee — use a manager, unique passwords and 2FA
🔒Privacy & Security
Private by Design
Everything happens on your device. The dictionaries and the entire analysis ship inside the page, so the password is scored in local JavaScript with no network request, no upload and no logging. We deliberately do NOT run a breach / HIBP check, because even the “k-anonymity” range-query version means sending a hash prefix of your password to a third party; keeping the input fully private is the choice we made. The password field is never persisted, no history is kept, and the built-in passphrase generator draws its words with crypto.getRandomValues (never Math.random). The tool works offline once cached, and the only optional network use anywhere on the site is consent-gated ads, which never see your password. This matters because the moment you type a real password into any online “checker” you can no longer be sure it stayed secret — here, by construction, it did.
Analysis and dictionaries run locally in JavaScript — nothing uploaded
No breach / HIBP lookup at all (not even a hash prefix)
Password field is never stored or logged; no history kept
Passphrase generator uses crypto.getRandomValues, not Math.random
Works offline once cached; only optional network use is consent-gated ads
Ways to judge how strong a password is
Approach
How it works
Trade-off
Used here
This client-side checker
Estimates attacker guesses by finding predictable patterns (zxcvbn-style) locally
Private + free + offline; realistic, but bundled dictionaries are small and there is no breach check
Yes
Complexity rules ("1 upper, 1 symbol")
Requires certain character classes
Simple, but rewards predictable “P@ssw0rd!” patterns and overstates strength
Rejected
Naive alphabet^length entropy
Multiplies character-set size by length
Easy to compute, but massively overstates human-chosen passwords
Improved on
Online breach-lookup checkers
Send a hash (or hash prefix) of the password to a service
Catches known-leaked passwords, but the password/hash leaves your device
No (privacy)
Everything here runs in the browser; the password is never uploaded and there is no breach lookup. The score is a pattern-aware estimate (zxcvbn-style), not a guarantee — pair it with a password manager, unique passwords and 2FA. As of July 2026.
