What makes a password weak?
Attackers don't guess passwords one at a time by hand. They use lists of billions of leaked passwords and rules that mimic how people build them. A password is weak if it shows up early in that process, even when it looks complicated. The most common problems are:
- It's too short. Every extra character multiplies the work for an attacker. Under 12 characters is risky for anything important.
- It's a word, name or date, or a small change to one, like
Summer2024!orMax1987. - It follows a pattern: keyboard rows (
qwerty,1qaz2wsx), repeats (aaaa) or sequences (abcd,4321). - It's been leaked before. Once a password appears in a breach, it's added to every cracking list, no matter how strong it looked.
- It's reused. A strong password used on many sites is only as safe as the weakest of those sites.
How to make it stronger
- Make it longer. Length beats complexity. 16 random characters, or 5–6 random words, is out of reach for any realistic attack.
- Let a computer choose it. People are predictable; a random password generator isn't. For passwords you have to remember, use a passphrase.
- Use a different password everywhere and keep them in a password manager.
- Turn on two-factor authentication so a leaked password alone isn't enough to get into your account.
Want the details?
Read how password cracking works to see exactly what attackers try first, or password vs passphrase to pick the right kind for each account.
More free tools
Is it safe to type my password here?
Yes. The check runs entirely in your browser; your password is never sent to us or stored. The optional leak check sends only the first 5 characters of a SHA-1 hash of it, which cannot be turned back into your password. Still, the safest habit is to test a password that is similar to yours rather than your real one.
How is the strength calculated?
We use zxcvbn, the open-source estimator built by Dropbox. Instead of just counting character types, it looks for the patterns attackers try first: common passwords, dictionary words, names, dates, keyboard rows like qwerty, repeats and sequences. It then estimates how many guesses an attacker would need.
What do the two cracking times mean?
The online time assumes someone guessing through a website's login page, which usually limits them to about 100 tries an hour. The offline time assumes the site was hacked and its password database leaked, so attackers can test 100 billion guesses a second on their own hardware. Your password should survive the offline case.
How does the leak check work?
It uses the free Pwned Passwords service by Have I Been Pwned, which holds hundreds of millions of passwords from real data breaches. Your browser sends the first 5 characters of the password's SHA-1 hash, gets back every leaked hash that starts the same way, and compares them locally. The service never learns which password you checked.
My password is "Strong". Is that enough?
For most accounts, yes, as long as you don't reuse it anywhere else. For your email, bank and password manager, aim for "Very strong": a random password of 16 or more characters, or a passphrase of 6 random words.
Why does P@ssw0rd! score so badly?
Because attackers know the trick. Swapping letters for look-alike symbols, adding a capital at the start and a number or "!" at the end are the first things cracking tools try. Real strength comes from length and randomness, which is exactly what our password generator gives you.