Password Strength Meter

Check how strong a password really is — estimated locally, never sent anywhere.

Test how strong your password really is. Free password strength checker and meter that scores and tests passwords privately in your browser — nothing is sent.

About Password Strength Meter

Password Strength Meter is a free, browser-based tool that scores how hard a password is to crack and estimates the time to break it, live as you type. It runs the zxcvbn-ts estimator (v4) locally with the English and common dictionaries, so it catches dictionary words, keyboard patterns, l33t substitutions, dates, and repeats — not just length and character classes. You get a 0–4 score with a friendly rating, the order-of-magnitude guesses (log₁₀), crack-time estimates for four attack scenarios, and concrete suggestions to improve weak passwords. Everything happens entirely in your browser — nothing is typed, stored, or uploaded, and there is no signup.

How to use Password Strength Meter

  1. Type or paste a password into the Password field — it is scored live as you type.
  2. Toggle 'Show password' (or the eye icon in the field) to reveal or hide the masked text.
  3. Read the five-segment strength meter and the score (0–4) with its rating from Very weak to Strong.
  4. Check the Score, Rating, and Guesses (log₁₀) stats for a compact view of how hard the password is to guess.
  5. Review the four 'Estimated time to crack' rows — offline fast hash, offline slow hash, online no-throttle, and online throttled.
  6. Read the Feedback section for zxcvbn's warning and suggestions, then revise the password and watch the meter update.

Frequently asked questions

Is my password uploaded or stored anywhere?
No. The password is checked entirely in your browser using the local zxcvbn-ts estimator — nothing is typed, stored, or sent anywhere. Close the tab and it is gone.
Is it free and do I need an account?
Yes, it is completely free with no signup, account, or limits.
What does the strength score actually measure?
It uses zxcvbn, which estimates how many guesses an attacker needs by detecting dictionary words, keyboard patterns, l33t substitutions, dates, and repeats — so a long-but-predictable password can still score low, unlike simple length-or-character-class checks.
What do the four crack-time estimates mean?
They model four attack scenarios: offline fast-hash GPU cracking (~10B guesses/sec, the worst case), offline slow-hash like bcrypt (~10k/sec), an online service with no rate limiting (~10/sec), and a throttled online service (~100/hour, the best case).
Is there a length limit on the password I can test?
The field is capped at 1,000 characters; if you paste more, the tool shows a warning instead of scoring. Note that zxcvbn itself only inspects the first 256 characters, so anything beyond that does not change the estimate.
Why does the result update a moment after I stop typing?
Scoring is debounced by about 200ms to keep the estimator off the per-keystroke path on longer inputs; you may briefly see an 'Analyzing…' state before the score settles.

People also search for

Password Strength Meter is also known as password strength test, password strength checker, check password strength, password strength tester, password strength calculator, how strong is my password.