How long your password would take to guess
Type a password and we will tell you how long it would actually hold out — not whether it ticks a list of rules. It is analysed right here on your device: never sent, never stored, never in your history.
Everything happens in your browser
As soon as you type something, the analysis appears below.
Or let us hand you a good one
Random words, drawn by your browser's cryptographic generator. Easy to remember and to type, very hard to guess.
Each word is drawn from a list of 256, so it contributes exactly 8 bits. That is not an estimate, it is multiplication.
What this does NOT do
- This is not a password manager. We analyse, we do not store: close the page and nothing remains.
- A strong password will not save you if you reuse it. One unrelated site getting breached takes it.
- We cannot tell whether someone already has YOUR password for YOUR account. Only whether that string appears in public breaches.
- The estimate assumes an attacker who already has the leaked hash. A well-built site locks them out long before.
This tool runs entirely inside your browser. There is nothing to upload, so there is nothing we can see, store or lose. You can disconnect from the internet and it will still work. The one exception is the breach check: that does need a connection, and it only runs if you press its button.
Frequently asked questions
Is it safe to type my password on this page?
The password is analysed inside your browser and is not sent to any server. You can verify it: open developer tools on the Network tab, type a password, and you will see no request take place. You can also disconnect your wifi and it will keep working. That said, the general good habit is not to type your real password into sites you do not know, and here you can test an equivalent variant instead.
How is the time to crack a password calculated?
It estimates how many attempts an attacker would need, accounting for real patterns: dictionary words in English and Spanish, names, dates, keyboard sequences and substitutions like "@" for "a". That attempt count is divided by the speed of three attack scenarios. The one that matters is the middle one: somebody who already has the leaked database and attacks it with a consumer graphics card.
What does it mean that my password appeared in a breach?
It means that exact string of characters already appears in public lists of passwords stolen from other services, and is therefore in the dictionaries attackers try first. It does not mean anyone has accessed your account. But if you use it anywhere, change it: trying it is the first thing any automated attack does.
Is a long password better than one with unusual symbols?
Long, by a wide margin. Length contributes far more resistance than character complexity, and it is also easier to remember. Four or five unrelated random words comfortably beat something like "P@ssw0rd!", which an attacker tries in the first few seconds precisely because it looks complicated while following a predictable pattern.
What is k-anonymity, and how does it protect my password during a breach check?
It is the method that lets you ask a question without revealing the question. Your browser computes the SHA-1 fingerprint of the password and sends only the first five characters of it. The server returns hundreds of fingerprints beginning the same way, and the final comparison happens on your device. Whoever is on the other end receives neither the password, nor its full fingerprint, nor any way to work out which of the hundreds of results you were asking about.