Check Your Password Strength

Enter your password to see how strong it is.

Your password is never saved or transmitted. All checks are performed locally in your browser.

What does this all mean?

This tool evaluates various aspects of your password strength for you to likely get Pwned. Here's the explanation of each category:

Complexity Rules

This checks if your password meets the explicit specified requirements. In the case of this tool, it's at least 8 characters long, an uppercase letter, a lowercase letter, a number, and a symbol. While this improves the bottom line for entropy, it doesn't guarantee the password is secure, as demonstrated by using a password like "Password123$".

Guessability

This evaluates whether your password isn't one that's randomly guessable. It does so by pattern matching common used passwords over commonly used names, popular words from Wikipedia, and even keyboard smashes like the good ol' "qwertyui".

Pattern Matches

This analysis breaks down your password into tokens and identifies patterns like dictionary words, names, dates, or repeated characters. For example, it can detect if you're using common substitutions like "a" to "@".

Estimated Crack Time

This provides an indication of how long it might take to break your password using common brute force methods. It's important to note that the security of your password also depends on how and where it is stored. Passwords stored in plain text are more vulnerable than those that are hashed and salted, which adds an additional layer of protection.

Resources

NIST Special Publication 800-63B: Passwords
Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords.