Password Strength Checker | Local Crack Time Test

Test password strength and estimated crack time with zxcvbn. The check runs locally in your browser, so your input is not uploaded.

Click for theater mode
Local check ยท works offline

Passwords are not uploaded. After the page loads, you can disconnect before testing.

Type a password or load an example to see the zxcvbn score, crack time, and suggestions.

How to Use

  1. After the page loads, disconnect your device from the network if you want extra peace of mind.
  2. Click "Load Weak Example" or "Load Strong Example" to see how the score changes.
  3. Type the password you want to evaluate, or use a similar pattern instead of the exact real password.
  4. Review crack time, score bar, warnings, and suggestions.
  5. Improve length, randomness, or phrase structure based on the feedback.

Core Features

  • zxcvbn-based scoring: The tool checks more than length, including common words, keyboard patterns, repetition, and dates.
  • Works after the page loads: The algorithm and dictionaries run in the front end, so you can disconnect before testing a sample password.
  • Readable crack time: See an offline slow-hashing crack time estimate with a clear risk score bar.
  • Real-time weakness feedback: Warnings and suggestions update as you type so you can improve the password structure.
  • Safer examples included: Load weak and strong sample passwords before deciding whether to test a same-pattern substitute.

Related Tools

Strong Password Generator - XKCD Passphrases & Entropy Tool

Strong password generator for random passwords or XKCD passphrases. See entropy and crack-time estimatesโ€”secure, client-side only. Generate yours now.
Bcrypt Hash Generator & Checker

Generate Bcrypt hashes locally and verify passwords against existing hashes with adjustable Cost/Rounds for auth development, migrations, and seed data.
SSH Key Generator โ€“ Ed25519 & RSA in Your Browser

Generate Ed25519, RSA-2048, or RSA-4096 SSH keys with browser Web Crypto. Copy an OpenSSH public key and download the private key as PKCS#8 PEM.
JWT Decoder & Debugger - No Key Upload, Private Local Tool

Decode and debug JWTs in your browserโ€”no secret key, no uploads. Inspect header/payload, pretty-print JSON, and see a live exp countdown. Paste offline now.
JWT Generator | Securely Create & Sign Tokens Offline

Generate and sign JWTs for API testing. Edit header and payload, use HS256/HS384/HS512, and keep your secret local while HMAC signing runs in the browser.
Hash Generator - Local SHA-256 & Checksum Tool

Generate SHA-256, SHA-384, SHA-512 hashes and file checksums locally in your browser. Compare expected values, copy results, and verify files without uploads.

Calculation Logic

This tool uses Dropbox's open-source zxcvbn password strength estimator. It estimates how many guesses an attacker would need, then translates that into a readable crack time for an offline slow-hashing attack scenario.

The check runs in the browser and does not send input to a backend. As a good security habit, prefer testing a same-pattern substitute instead of your exact real password.

FAQ

Is it safe to type my real password?

The tool does not upload your input, but the safer habit is to test a same-pattern substitute rather than the exact real password, especially on shared devices.

How is crack time calculated?

zxcvbn estimates guesses from dictionaries, keyboard patterns, repetition, dates, and composition, then converts the guesses into time.

Why can a long password still be weak?

If it is built from common phrases, sequences, or known patterns, attackers may guess those patterns early, reducing the benefit of length.

Does it work offline?

After the page loads, the evaluation logic runs locally in the browser, so you can disconnect and keep testing.

Does a high score mean the password cannot be cracked?

No. A high score means the pattern is harder to guess and more expensive to attack. It does not guarantee permanent safety or replace a password manager and two-factor authentication.