How to check a password
- Type or paste a password into the box. Tick Show password if you want to see what you typed.
- Read the strength label and the estimated number of guesses an attacker would need.
- Look at the crack times for four situations, from a website that limits tries to a stolen password file attacked with fast hardware.
- Read What we found to see the weak spots, then follow the suggestions below it.
What the strength labels mean
| Label | Guesses needed (about) | What it means |
|---|---|---|
| Very weak | Under 10,000 | Found in seconds by a basic script. |
| Weak | 10,000 to 100 million | Falls fast if a site leaks its password file. |
| Fair | 100 million to 100 billion | Fine only for low value accounts. |
| Strong | 100 billion to 100 trillion | Good for most accounts. |
| Very strong | Over 100 trillion | Hard to crack even with fast hardware. |
Tips for better results
- Length helps more than odd characters. Aim for 12 characters or more, and 16 for email and banking.
- A passphrase of four or more unrelated words is easy to remember and hard to guess.
- Use a different password for every account. If one site leaks, the others stay safe.
- Let a password manager create and store them. The Password Generator can make a random one.
- Turn on two-step verification wherever it is offered.
Limits to know about
- The score is an estimate built from common patterns: a small list of common passwords and words, keyboard runs, repeats, sequences and dates. Real attackers use much larger lists.
- A password made from a real word that is not in our list can be weaker than the result shows. Letters that look like a word are treated as a word, but this is a rough guess.
- Crack times assume a fixed guessing speed and an attacker who knows how people build passwords. Real speeds depend on how the site stores passwords.
- The tool cannot tell whether your password appeared in a past data breach, or whether you reuse it.
- Passwords shorter than 8, 10 and 12 characters are capped at Weak, Fair and Strong, because short passwords carry extra risk.
Privacy
The password is scored by code running in your browser. It is not sent to our server or to any other service, and it is not saved. Even so, avoid typing the password of an important account into any website you do not control. Test a similar one instead.
Frequently asked questions
Is it safe to type my real password here?
The check runs in your browser and nothing is sent anywhere. Still, a safer habit is to test a password with the same pattern and length, not the exact one.
How is the crack time worked out?
The tool estimates how many guesses are needed, divides by a guessing speed, and halves it because on average an attacker finds the password halfway through. The four speeds are 100 tries per hour, 10 per second, 10,000 per second and 10 billion per second.
Why is Password@123 rated weak?
It is a common word, a common symbol swap and a simple number run. Attackers try these combinations first, so the extra characters add very little.
Do symbols and capital letters make a password strong?
They help a little, but only when they are not predictable. A capital at the start and a number at the end are very common habits. More length is a better use of effort.
What length should I use?
At least 12 characters for normal accounts and 16 or more for email, banking and your password manager.
Do you check data breaches?
No. This tool only scores how guessable the password is. It does not look it up anywhere.
About this tool
ToolsRiver Password Strength Estimator is free and needs no sign up. It runs entirely in your browser and uses its own pattern checks. The numbers are estimates meant to help you choose better passwords, not a security audit.