100% in-browser · your passwords are never transmitted

Password Strength Checker — Real Crack-Time + Tips (In-Browser)

Check how strong your password really is with zxcvbn real-world scoring, an estimated crack-time, and plain-English tips. The password is NEVER transmitted. 100% in-browser. Free.

Loading tool…

More tools

All free, all private — everything runs in your browser.

Check

Password Breach Checker

Check if your password appears in known data breaches using Have-I-Been-Pwned k-anonymity. Only a 5-char hash prefix leaves your device — your password NEVER does. 100% private. Free.

Generate

Password Generator

Generate strong, random passwords with configurable length and characters. Powered by WebCrypto, with live entropy shown. 100% in your browser — never transmitted. Free.

Generate

Passphrase Generator

Generate memorable 'correct-horse-battery-staple' passphrases from the EFF diceware wordlist. Choose your word count. Strong and easy to type. 100% in-browser. Free.

Generate

Pronounceable Password Generator

Generate passwords that are easy to read and say aloud but still strong, built from random syllables with WebCrypto. Easier to remember, hard to crack. 100% in-browser. Free.

Generate

PIN Generator

Generate random numeric PINs from 4 to 8 digits for banking, phone, and SIM cards, with WebCrypto randomness. No patterns, no repeats. 100% in-browser. Free.

GeneratePro

Bulk Password Generator

Generate dozens or hundreds of strong passwords at once with WebCrypto, then export the batch as CSV, JSON, or .zip. All in your browser — nothing is ever transmitted. Free + Pro.

How to use Password Strength Checker

  1. 1Type or paste a password into the box. It is scored locally with zxcvbn — never transmitted.
  2. 2Read the 0–4 strength score and the estimated time to crack.
  3. 3Follow the plain-English tips to improve any weakness (length, patterns, common words).
  4. 4Regenerate a stronger password with the Password Generator when you're ready.

Password Strength Checker FAQ

Is it safe to type my real password here?
Yes. The strength estimation runs entirely in your browser with zxcvbn. Your password is never sent over the network, never logged, and never stored — there is no backend to receive it.
How does the strength estimate work?
It uses zxcvbn, Dropbox's open-source estimator, which models real attacker techniques: dictionaries, common substitutions, sequences, keyboard patterns, and repeated characters. It returns a score 0–4 and a realistic guess count.