Checking a Password without Sending It to the Server
Enter a sample in Password to check. The analysis runs in your browser and updates as you type. Select View results to bring the completed result into view. The input field then clears, while the result stays visible.
The password is not sent outside the browser by this check. You can use a test example instead of a real account password to explore the feedback. Local processing does not make an untrusted computer or browser extension safe, and showing the value can expose it to someone nearby.
Use a single line containing no more than 128 visible characters. Some sequences of combined Unicode characters reach the processing limit sooner. The check rejects control characters and incomplete Unicode sequences. If the browser cannot reliably process combined characters, the tool reports that problem rather than supplying a score for a different value.
Interpreting the Strength Rating
The rating ranges from Very weak to Very strong. It estimates how predictable the password is by looking for common passwords, dictionary words, sequences, dates, repeated text, and keyboard patterns. The checker is not simply counting whether uppercase letters, numbers, and symbols are present.
A long but familiar phrase or a repeated pattern can remain easy to guess. Likewise, predictable substitutions can leave a recognizable word intact. Read the warning and suggestions below the rating to see which patterns make the sample easier to guess.
The estimated guess count comes from the analysis model, not from an attack against your account. The checker does not know the account's security controls or what an attacker already knows about you. Treat the rating as feedback about the password text, not proof that an account is secure.
Comparing the Four Time Estimates
Each cracking time uses a different assumed guessing rate. The rows are separate scenarios, so their estimates should not be added together or averaged. The same password can have a long online estimate and a much shorter offline estimate because the number of guesses available per second is different.
- An online attack with a guess limit uses 100 guesses per hour.
- An online attack without that limit uses 10 guesses per second.
- An offline attack against a slow password hash uses 10,000 guesses per second.
- An offline attack against a fast password hash uses 10 billion guesses per second.
An online attacker submits guesses to a service. An offline attacker has obtained password verification data and can test guesses without that service's login limit. The listed rates are fixed assumptions for comparison; actual speed depends on the system, password hashing method, hardware, and other conditions.
A result expressed in years is not a promise that the password will remain safe for that period. Exposure through phishing, reuse, malware, or a data breach does not require an attacker to complete the modeled guessing process.
Using the Suggestions to Improve a Sample
Use the feedback to identify predictable choices before comparing another sample. Increasing length can help, but adding a familiar ending to a known password may not remove its main weakness. A fresh, unique password avoids carrying the same secret across several accounts.
The checker can also receive a newly generated password from Password Generator in the same tab. That transfer is used once; refreshing the result does not load the generated password again. No password is placed in the destination URL.
Checks That Are Not Included
This check does not search breach databases, verify ownership of an account, or test whether a password successfully logs in anywhere. A strong rating cannot show that a password is unused, confidential, or accepted by a particular service.
When the Check Is Unavailable
If the analysis script fails to load, the page reports that the check is unavailable. Refreshing can retry the load. Do not treat a missing rating as a weak score or assume a displayed result belongs to new input when the page reports an error.
