Password Strength Checker

Check a Password

This password checker rates how guessable a password is and estimates how long an offline attack could take. Type a password to see the result, or select “Load example” to try a deliberately weak example.

The password stays in this browser tab. The checker sends no password to a server, writes no saved history and excludes the tool area from analytics recordings. Select “Clear password” when you finish. Reloading or leaving the page clears the entry.

The rating uses zxcvbn’s bundled password lists and pattern matching. It recognises common words, keyboard runs, repeated text and predictable character substitutions. The estimate divides the predicted guess count by 10 billion guesses per second.

For example, 10 billion estimated guesses gives one second under this attack model. That assumes an attacker has stolen password hashes and can test guesses offline. Actual time depends on the hash method and attacker hardware.

A high rating cannot establish that a password is unique or secret. The checker does not look up breaches or know your personal information. A stolen password can give someone access immediately, whatever its rating.

Make a Weak Password Stronger

Use a longer, unpredictable password that you keep for one account. The Australian Cyber Security Centre recommends unique, unpredictable passwords of at least 15 characters.

A passphrase combines unrelated words into a longer password. Choose words randomly. Familiar quotations, song lyrics and a business name followed by a year remain predictable even when they are long.

Adding an exclamation mark or changing “a” to “@” often leaves a common password easy to guess. Replace the underlying pattern. Use the password generator to make a fresh password, then store it in a password manager.

Use a different password for your customer relationship management (CRM) system, email and each lender portal. Reusing a password lets a breach at one service put the other accounts at risk. Enable multi-factor authentication wherever the service supports it.