Free Password Strength Checker

Most strength meters multiply password length by character-set size and call anything over a threshold 'strong'. This is wrong: 'P@ssw0rd123!' scores great on naive math, but it's in every cracking dictionary and falls to a real attack in seconds.

zxcvbn estimates strength by simulating actual cracker behavior: dictionary lookup, leet-substitution unrolling, keyboard-pattern detection, year-and-date detection. The score reflects how an actual attacker would approach the password, not the theoretical entropy.

Score 0 (too weak): cracked in under a second, even by an online rate-limited attacker. Replace immediately.

Score 1–2 (weak): cracked in minutes to hours by an offline attacker. Acceptable only for throwaway accounts.

Score 3 (decent): resists most offline attack budgets. Fine for normal-value accounts.

Score 4 (strong): resists the most realistic offline attack budgets for the foreseeable future. Aim here for sensitive accounts; pair with TOTP for the most sensitive.

Generate a replacement with PassCryp's password generator (20+ random characters, full symbol set). Save to vault. Rotate at the upstream site. Check breach monitoring to confirm the old password isn't already in HIBP — if it is, treat any account using it as exposed.

For master passwords specifically, use the generator's Passphrase mode: 5+ random words from the EFF long wordlist. Hits score 4 and stays memorable.