See how long it takes to guess passwords of varying lengths and types. Nothing you choose here leaves your browser.
Analysed entirely in your browser and never stored. Nothing is sent anywhere unless you choose to check Have I Been Pwned below, and even then the password itself never leaves your device.
Checks whether this password has appeared in a known data breach. Only the first 5 characters of the password's SHA-1 hash are sent to haveibeenpwned.com; the match is done in your browser.
Time to try every combinationOn average an attacker succeeds in about half that: .
Patterns found: the real guessing time is likely far shorter
characters possible passwords ÷ guesses per second
But what if your password is made of words?
The average English word is about 5.5 characters long, so a password of characters may consist of just words. Even if those words were picked at random from a list of 7,776 (the size used for Diceware passphrases), the password would have only bits of entropy and possible combinations. At the selected attacker speed, it could be guessed in .
Important: what do these results mean?
This is not a password strength calculator!
It measures how hard a password is to guess at random. These results show how long an attacker would take to randomly guess . That gives you an idea of the search space an attacker must work through.
It does not take into account what your password is actually made of. If it contains easily identifiable words (such as the name of your child or pet), dictionary words or common passwords (like 123456), an attacker can crack it quickly using lists of common passwords, names and so on. And if your password is a string of common words, its entropy is lower, which shortens the time needed to guess it.
The Test a password tab flags some common patterns, and can check Have I Been Pwned, but no tool can spot every weakness. A password with no warnings isn't guaranteed to be strong.
What makes a password strong?
In the simplest terms, a password's strength is how hard it is to guess at random. That's why every service you use should have its own password that is long and mixes numbers, upper- and lowercase letters, and special characters. But have you ever wondered why? Why do passwords need to be long? Why should they contain letters, numbers and special characters?
To start, consider a password limited to 4 numeric characters (0–9), like the 4-digit passcodes used to unlock smartphones and tablets. Someone trying to guess it has 10,000 possible options (0000 to 9999). A reasonably fast system that makes 2 billion guesses a second could crack this 4-digit password in 5 microseconds (5 millionths of a second)!
So how can we make our hypothetical password more secure? First, we can let it include letters as well as numbers. If we use both capital and lowercase letters, our 4-character password draws from a much larger search space (0–9, A–Z and a–z). To guess it correctly, an attacker now has to work through 14,776,336 possibilities. At 2 billion guesses a second, the same system needs 7.4 milliseconds (7.4 thousandths of a second). That's still very short, but simply enlarging the search space has made our password 1,478 times stronger.
We can improve it further by adding symbols. If we include the 32 symbols on a standard keyboard, our 4-character password has 78,074,896 possible combinations. The attacker now needs 39 milliseconds, 5.3 times longer than when only letters and numbers were allowed. Making the password longer helps even more. A 5-character password of letters, numbers and symbols has 7,339,040,224 possible combinations and takes 3.7 seconds to guess. Adding just one character made it 94 times stronger!
How the numbers are calculated
The number of possible passwords is NL, where N is the number of characters in the pool and L is the length. Entropy in bits is L × log2(N). Each extra bit doubles the number of guesses needed.
In the Test a password tab, the pool is made up of every character type your password contains. Characters outside standard ASCII (accented letters, emoji, etc.) are counted as roughly 100 extra possibilities. The tool also checks for common passwords, common words (including swaps like @ for a), repeated characters, sequences, keyboard patterns and years.
These figures assume the password was chosen randomly from the selected characters. Human-chosen passwords, such as dictionary words, names, dates or common substitutions like “P@ssw0rd”, are guessed far faster than these numbers suggest. For truly random passwords, use the Password Generator.
How the Have I Been Pwned check protects your password
The check uses the Pwned Passwords service run by Troy Hunt, which lists hundreds of millions of passwords exposed in real data breaches. It only runs when you click the button.
Your browser computes the password's SHA-1 hash locally and sends just the first 5 of its 40 characters. The service replies with every breached hash starting with those 5 characters (hundreds of them, plus random padding), and your browser checks for a match itself. Neither the service nor anyone watching the connection learns your password or its full hash. This technique is known as k-anonymity.
About attacker speeds
Real guessing speed depends on how a site stores passwords. Logging in through a website is usually rate-limited. Stolen password databases can be attacked offline at billions of guesses a second if they use a fast hash, or far more slowly if they use a deliberately slow algorithm such as bcrypt, scrypt or Argon2.