Password Strength Checker
Analyze your password with zxcvbn, the algorithm Dropbox built that today backs password managers like Bitwarden and 1Password: a 0-4 score, real crack time across four attack scenarios (online and offline), concrete warnings on why it's weak, and a breakdown of every detected pattern. The analysis runs in your browser.
Analysis runs in your browser with Dropbox's zxcvbn algorithm. Nothing is sent to any server or stored.
Built by
Miguel Ángel Colorado Marin (MACM)
Built by
Miguel Ángel Colorado Marin (MACM)
Full-Stack Developer · Guadalajara, España
I develop web apps, digital tools and full projects — from design to deployment.
Password strength isn't «how many symbols»: it's how many attempts a real attacker needs. zxcvbn — the algorithm Dropbox built and password managers back today — models the attacker: breach password lists, dictionary words, keyboard patterns (qwerty), sequences, repeats, dates and names. It estimates guess counts and crack time across four realistic scenarios, from a throttled online attack to fast GPU hashing. Here it runs with the real dictionaries (leaked passwords, Wikipedia words, names) plus warnings and suggestions translated to English. Everything is computed in your browser: the password never leaves your device and is never stored.
Features
- ✓Dropbox's real zxcvbn algorithm: 0-4 score in real time
- ✓Crack time across 4 scenarios: throttled/unthrottled online, slow and fast offline hashing
- ✓Concrete translated warnings (sequences, repeats, dates, keyboard patterns…)
- ✓Pattern breakdown: see exactly which chunks of your password are weak and why
- ✓Personal info exclusion (name, username…) to catch guessable passwords
How to check a password's strength?
- 1
Type the password
Score and crack times update as you type, without sending anything to any server.
- 2
Read the score
0-4 with a color bar: «Very weak» for trivial passwords, «Very strong» above 10¹⁰ guesses.
- 3
Check the warnings
The «How to improve it» panel explains the giveaway: sequences, dates, l33t substitutions, keyboard patterns…
- 4
Add your personal info
Type your name or username in the optional field: passwords built from them get flagged as guessable.
Frequently asked questions
Why does it say my password with symbols is weak?
Because symbols don't matter when the rest is predictable: p@ssw0rd is a known breach password with a typical l33t substitution (@, 0) and a keyboard pattern. Attackers try those variants first. The passphrase correcthorsebatterystaple, with no symbols at all, is far stronger than most «complete» passwords.
What do the four crack-time scenarios mean?
From most to least optimistic: throttled online (the server allows 100 attempts/hour), unthrottled online (no rate limit), slow offline hash (the leaked database uses bcrypt, 10⁴/s) and fast offline hash (the leak uses SHA-1, 10¹⁰ per second on GPUs). For important accounts, judge by the slow offline hash row.
Is my password sent or stored?
No. The analysis runs entirely in your browser with the zxcvbn library: there are no network requests, nothing is stored, and nothing ends up in your history. You can verify it yourself with the developer tools network tab while typing.
Related tools
Embed Password Strength Checker on your site
Add Password Strength Checker to any web page with a simple iframe. Free, with attribution to miguelacm.es.
<iframe
src="https://miguelacm.es/embed/password-strength-checker"
width="100%"
height="700"
frameborder="0"
title="Password Strength Checker — miguelacm.es"
></iframe>