Password strength checker — how strong is your password?
We measure strength locally on our server and check it against billions of known breached passwords using k-anonymity — only the first 5 characters of a one-way hash ever leave us, so the lookup service can't see your password and we never store it.
Common questions
How strong is my password — what does the checker measure?
We score length, character variety, dictionary patterns, common substitutions (P@ssw0rd), keyboard runs (qwerty), and estimated crack time at modern GPU speeds. The result is a 0–4 score from Very weak to Excellent.
What makes a strong password in 2026?
Length beats complexity. Aim for 14+ characters using a passphrase of three or four unrelated words plus a number or symbol. Unique per site, stored in a password manager, and protected with two-factor authentication on important accounts.
Has my password been in a data breach?
We check it against billions of breached passwords using k-anonymity — only the first 5 characters of a one-way SHA-1 hash leave our server, so the lookup service can't see your password. If it shows up in any known breach, change it everywhere you've used it.
Is it safe to type my password into this website?
Yes. The password is checked in-memory on our server, never logged, never written to disk, and never sent to a third party in clear. Even better, change a suspect password somewhere else first, then test the new one here.
What should I do if my password is weak or breached?
Change it on that account first. Then use a password manager to generate a unique 16+ character password for every important account (email, bank, cloud storage). Turn on two-factor authentication where available — that single step blocks the vast majority of account takeovers.