Password Strength
Type a password and see how long it would take someone to crack it — and exactly what makes it weak. Nothing you type leaves your device.
Start typing — the analysis updates with every keystroke.
What makes a password weak?
People who break into accounts don’t guess randomly. They start with lists of passwords leaked from other websites, then try common words with small tweaks (p@ssw0rd), keyboard patterns (qwerty), years and dates. A password can look complicated and still fall in seconds if it follows one of these habits.
The fix is simple: make it long and random. Let the Password Generator make one for you, and keep them in the vault.
Why does a leaked password matter?
If your password showed up in a data breach, attackers try it first — no matter how strong it looks. The check compares it against more than 900 million leaked passwords, without ever sending it.
For the technical folks
Entropy starts from length × character pool and is reduced for dictionary words, sequences, repeats, keyboard walks and dates. Crack times assume the attacker finds it halfway through on average. The leak check uses k-anonymity: the first 5 characters of the SHA-1 hash go to Have I Been Pwned and the matching is done here.
More tools