Password checker and generator
Type a password to see how long a realistic attacker would need to crack it, and what to fix. Or generate a strong one.
The same goes for the generator. Passwords are created in your browser. This site has no way to see them, and no way to know whether you copy or use one, or where you use it.
Strength:
Estimated time to crack
What to improve
Has it been leaked? (optional)
This checks the password against the Have I Been Pwned list of leaked passwords. Your browser hashes the password and sends only the first 5 characters of that hash to their server, which returns every match for those 5 characters. Your browser looks for the full match itself. The service never sees the password or its full hash. This is the only thing on this page that contacts another server, and only when you press the button.
Need a strong password? Generate one
Made in your browser using its secure random number generator. Nothing is sent anywhere or stored, and each click makes a new one. This site cannot see what you generate, cannot tell whether you copy or use a password, and cannot know where you use it.
Estimated time to guess this password (on average)
These are broad estimates, not promises. They assume the attacker knows exactly how the password was made and has to try every possibility, and they use today's typical hardware, which keeps getting faster. Passwords this random are almost never cracked by guessing. They are lost to phishing, malware, or a site that stores them badly, which no password strength can fix.
Word list: the EFF Long Wordlist (7,776 words), used under CC BY 3.0. Five random words is about 65 bits of randomness, which is good for most accounts; use six or more for anything important, such as your email or password manager. Save the result in a password manager and use it for one account only.
What actually makes a good password
- Length beats complexity. Four or five random words (a passphrase) is stronger and easier to remember than
P@ssw0rd!. See the EFF dice method. - Use a different password for every account, stored in a password manager (see Resources), and turn on two-factor authentication for email and banking.
- A strong score means hard to guess. It does not protect you from phishing or from a site that stores passwords badly.