Password Strength Test
Are you concerned that your password is too weak? Find out for yourself using our password checking tool below!
Don't worry; we value your security and do not transmit your password anywhere. Everything is done locally in your browser.
Score: 0
Results
Guesses
How long would it take to crack?
| Online (Throttling) | Online (No Throttling) | Offline (Slow Hashing) | Offline (Fast Hashing) |
|---|---|---|---|
|
Instantly |
Instantly |
Instantly |
Instantly |
Feedback
Understanding the Results
- Too guessable; Risky password. No protection guaranteed. (guesses < 10^3)
- Very guessable; provides some protection against throttled online attacks. (guesses < 10^6)
- Somewhat guessable; provides some protection against unthrottled online attacks. (guesses < 10^8)
- Safely un-guessable; provides moderate protection against offline slow-hash scenario. (guesses < 10^10)
- Very un-guessable; strong protection against offline slow-hash scenario. (guesses >= 10^10)
Online (Throttling) – 100 attempts per hour: Online attack on a service that rate-limits password authentication attempts.
Online (No Throttling) – 10 attempts per second: Online attack on a service that doesn’t rate-limit, or where an attacker has outsmarted rate-limiting.
Offline (Slow Hashing) – 1×104 attempts per second: Offline attack; Assumes multiple attackers, proper user-unique salting, and a slow hash function, with a moderate work factor, such as bcrypt, scrypt, PBKDF2.
Offline (Fast Hashing) – 1×104 attempts per second: Offline attack with user-unique salting but a fast hash function like SHA-1, SHA-256 or MD5. Considers a wide range of reasonable numbers anywhere from one billion – one trillion guesses per second, depending on number of cores and machines.