Password strength checker
Realistic strength scores and crack times, checked on your device.
How it works
- 01Type or paste a password. It is checked as you type, entirely on this page.
- 02Read the score, the crack time for each kind of attack and the tips.
- 03Optionally check whether it has shown up in a known data breach.
Questions
›How is the strength measured?
With zxcvbn, the open-source estimator Dropbox created. Instead of just counting symbols, it looks for what attackers actually try first: common passwords, dictionary words, names, dates, keyboard patterns like "qwerty", repeats and l33t swaps. It then estimates how many guesses a cracker would need.
›What do the four crack times mean?
They are the same guess count at different speeds. A login page that limits attempts allows about 100 guesses an hour. An unprotected one, about 10 a second. If a site's password database leaks, attackers guess offline: around 10,000 a second against slow hashes such as bcrypt, and about 10 billion a second against fast ones like MD5. These are rough planning figures, not guarantees.
›Is the breach check safe?
Yes. It is off until you click it. Your password is hashed with SHA-1 on your device and only the first 5 characters of that hash go to Have I Been Pwned. The service returns hundreds of matching hash endings, and the comparison happens in your browser, so neither the password nor its full hash is ever sent.
›What makes a good password?
Length and randomness. Four or more random words, or 16+ random characters from a password generator, beat clever substitutions like P@ssw0rd. Use a different password for every site and keep them in a password manager.
›Is my data uploaded anywhere?
No. This tool runs entirely in your browser, and Rounder never sends what you type or drop in to a server, ours or anyone else's. Once the page has loaded, along with any AI model the tool uses, it even works offline.