PrivTab

Password Strength Checker

Type a password to see how long it would take to guess, and what gives it away.

Runs in your browser · No uploads

Your password is checked inside this browser. It is never sent anywhere: this page isn't able to send anything.

Words about you Optional: your name, email, birthday or pet's name, to see if the password uses them

Loading the list of common passwords…

  • Nothing leaves your device
  • No server-imposed size limits
  • No sign-up, no watermark
  • Free

How to check a password

  1. Type or paste the password.
  2. Optionally add words about you, such as your name or birthday.
  3. Read the rating, the time to guess it and the tips.

How it is checked

The checker is zxcvbn, the estimator many sign-up forms use. It looks for what attackers try first: the 30,000 most common passwords, keyboard patterns such as "qwerty", sequences such as "abcd" or "1234", repeats, dates and years, letters swapped for look-alikes ("p@ssw0rd"), and the words about you that you add.

It then estimates how many guesses the password would take, and how long that is in four situations, from a website that limits tries to a stolen database with weak protection.

Good to know

  • It is an estimate. A strong rating means the password has no pattern attackers commonly try, not that it is unbreakable.
  • A password that uses the words about you is rated Fair at most, however long it is: anyone who knows you, or finds you online, would try those first.
  • It doesn't know every word in every language, so a single real word with small changes may look a little stronger than it is.
  • It can't tell whether a password has appeared in a data breach: that would mean sending it, or part of its hash, to another website, and this page sends nothing.
  • The best passwords are long and random: four or more random words, or one made by a password manager or the Password Generator.

Your password stays on your device

The check runs in your browser. The password is never uploaded, stored or logged, and this site's security policy blocks the page from sending anything anywhere.

Frequently asked questions

Is it safe to type my real password here?

The page can't send anything: its security policy blocks every connection, which you can confirm in your browser's developer tools. Still, the safest habit is to check a password that is similar to the real one, and to use a password manager.

Why is "P@ssw0rd123!" rated weak when it has every kind of character?

Because it is a common word with predictable changes, and attackers try those first. Length and randomness matter much more than symbols.

Guides for this tool