Password Strength Checker
Estimate password strength and crack time, privately.
Checked only in this page: the password is never sent over the network or saved. The results are an estimate, not a guarantee.
Use via API
Estimate a password's strength like zxcvbn: entropy in bits, a 0–4 score, detected weak patterns (common passwords, sequences, keyboard runs, dates, repeats), estimated crack times and suggestions. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/password-strength-checker
curl https://pithlab.com/api/v1/tools/password-strength-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"password":"Summer2024!"}'About the Password Strength Checker
Estimate how strong a password is, how long it could take to crack, and how to improve it. Spots common passwords and patterns. Nothing is sent or stored.
How to use the Password Strength Checker
- Type or paste a password. It stays in this page only: it is never sent over the network or saved.
- Read the strength rating, the estimated entropy in bits and the estimated time to crack it in four attack scenarios.
- Check the patterns found, such as common passwords, sequences, keyboard runs or dates, and follow the suggestions.
- Use Show to check what you typed, and clear the box when you are done.
Examples
Input
password
Output
Very weak (about 2 bits). This is one of the most common passwords.
Input
P@ssw0rd
Output
Very weak (about 5 bits). This is a lightly disguised version of a very common password.
Input
Summer2024!
Output
Very weak (about 21 bits). Contains a very common password or word ("Summer").Input
correct horse battery staple
Output
Fair (about 59 bits).
Input
kX9#vQ2!mZ7$pL4w
Output
Very strong (about 105 bits).
Frequently asked questions
Is it safe to type my real password here?
The check runs entirely in your browser; the page makes no network requests with it and never stores it. Even so, the safest habit is to test a password that is similar in structure rather than one you actually use.
How accurate is the crack time?
It is an estimate. It assumes the attacker knows common passwords and patterns, and uses typical guessing rates for each scenario. Real attackers use huge breach lists and dictionaries, so a password built from real words or names may be weaker than shown.
What does entropy in bits mean?
Each bit doubles the number of guesses needed. A truly random password from 94 printable characters gains about 6.6 bits per character. Patterns such as words, sequences and dates reduce the effective bits far below that.
Why do the four scenarios differ so much?
A website that limits login attempts may allow only around 100 guesses an hour, while a stolen database of fast, unsalted hashes can be attacked at billions of guesses per second. Slow hashes like bcrypt sit in between.
What makes a strong password?
Length and randomness. Use a password manager to generate a unique 16+ character password for each site, or a passphrase of four or more random words, and turn on two-factor authentication.