About the Password Strength Estimator
The coloured bar on a signup form is theatre. It counts character classes, so it rewards P@ssw0rd1 and punishes peculiar tractor vinegar — the exact opposite of what a cracking rig experiences. This tool models the attacker instead.
It decomposes your password the way hashcat with a rule set would: dictionary words, names, reversed words, l33t substitutions, keyboard walks like 1qaz2wsx, repeats, runs, and dates. Each fragment gets a guess cost, and a dynamic program finds the cheapest way to assemble the whole string — the guess count that actually matters. The method is the one published by Dan Wheeler in zxcvbn: Low-Budget Password Strength Estimation (USENIX Security 2016).
That guess count is then divided by real, published GPU throughput for the algorithm a site might be using. This is where most advice goes wrong: the same password survives roughly nine orders of magnitude longer behind bcrypt than behind unsalted MD5, and you do not get to choose which one the site picked. Finally, a k-anonymity lookup checks the string against Have I Been Pwned’s corpus of around 900 million breached passwords — only the first five characters of its SHA-1 hash are ever transmitted.
The top two are what protects you at a site with working rate limits. The bottom two are what happens after that site is breached.
Every storage algorithm against every attacker scale, for this password.
Drop a CSV export from 1Password, Bitwarden, LastPass, Chrome or Firefox. The file is read in your browser and never uploaded. Only SHA‑1 hash prefixes are sent, one per unique password, to run the same breach check.
Share, export and save carry the analysis only — entropy, guess count and verdict. The password itself is deliberately never placed in a URL, a file or your saved history.
How to Use the Password Strength Estimator
Type a password into the field. Everything below it updates as you type, computed by JavaScript running on your own machine — nothing is transmitted. Then set the two things that decide the answer: how the site stores the password and who is attacking. Those two choices move the crack time by more than a dozen orders of magnitude, which is why a single number on a signup form is close to meaningless. Read the decomposition table to see exactly which fragments of your password a cracking rig would recognise, and check the breach result — if the string appears there, nothing else on the page matters.
Why Strength Meters Lie
Almost every strength bar you have seen scores character classes and length:
one point for an uppercase letter, one for a digit, one for a symbol. That model has a fatal
flaw — it assumes the attacker guesses randomly. Real attackers do not. They run
hashcat or John the Ripper with a wordlist and a rule set, and
those rules encode precisely the transformations humans make: capitalise the first letter, append
a year, swap a for @, add an exclamation mark. Against that,
P@ssw0rd1 is not a nine-character random string. It is one dictionary word plus four
rules, and a mid-range GPU walks through every combination of those rules in under a second.
The model here scores the opposite way round. It searches for structure — words, names, reversed words, l33t spellings, keyboard walks, runs, repeats and dates — and then finds the cheapest way to build your password out of those pieces. If a password can be assembled from three recognisable parts, the estimate reflects three parts, not twelve characters. That is a deliberately pessimistic reading, and it is the right one: a strength estimate that can be beaten by an attacker with a better wordlist was never a strength estimate.
The Nine Orders of Magnitude Nobody Mentions
The single largest factor in how long your password survives is a decision you never got to make: which hashing function the site chose. Compare the throughput one RTX 4090 achieves:
- NTLM (Windows domain hashes) — around 288 billion guesses per second.
- MD5 — around 164 billion per second. Still found in old PHP applications.
- SHA-1 — around 50 billion per second.
- SHA-256, unsalted and uniterated — around 22 billion per second. A fast general-purpose hash is not a password hash.
- PBKDF2-HMAC-SHA256 at 600,000 iterations — around 11 thousand per second.
- bcrypt at cost 12 — around 1.4 thousand per second.
That is a factor of roughly 200 million between the top and bottom of the list, and each step down buys you the same protection as adding several characters. Password hashing functions are deliberately slow: bcrypt’s cost parameter and PBKDF2’s iteration count exist purely to make the attacker’s hardware advantage evaporate. If you build systems, this is the whole lesson — use Argon2id, bcrypt or PBKDF2 with current parameters, and never a bare SHA function. If you only use systems, assume the worst case for anything that predates about 2015.
Length Beats Complexity, and It Is Not Close
Every character you add multiplies the search space; every symbol you substitute merely adds a rule the attacker already runs. A four-word passphrase drawn at random from a 7,776-word list carries about 51.7 bits of entropy — 7,776 × 7,776 × 7,776 × 7,776, or roughly 3.7 quadrillion possibilities — and you can actually remember it. Five words take it to 64.6 bits, which is out of reach even for a well-funded attacker against a slow hash. The catch is the word random: a phrase you invent yourself carries far less entropy than the word count suggests, because you are choosing from the few thousand words and grammatical patterns that come to mind, not from the full list. Roll dice, or let a generator do it.
NIST formalised this in SP 800-63B: it recommends a minimum of eight characters,
supporting at least 64, screening new passwords against known-breached lists, and explicitly
dropping mandatory composition rules and routine expiry. Both of those old habits push
people toward predictable patterns — the Summer2024!, Autumn2024!,
Winter2025! cycle is a direct product of a 90-day rotation policy.
What the Breach Check Actually Does
Have I Been Pwned publishes a corpus of roughly 900 million passwords recovered from real breaches, indexed by SHA-1 hash. Querying it naively would mean sending your password, or its hash, to a third party. The k-anonymity protocol avoids that entirely: your browser hashes the password locally, sends only the first five hexadecimal characters of that hash, and receives every hash in the corpus that starts with those five characters — typically around 800 of them, padded further to obscure the response size. The comparison happens on your machine. The service, and this site, learn only that somebody looked at one bucket out of 1,048,576, which tells them nothing.
A hit means the exact string is in public cracking wordlists. It does not mean any account of
yours was breached, and a password can be absent from the corpus and still be terrible —
Correcthorse2026! is probably not in there and is still guessable by rules. Treat the
corpus check as a hard veto, not as a pass mark.
Where These Numbers Come From, and Their Limits
Guess counts use the estimation model from Dan Wheeler’s zxcvbn: Low-Budget Password Strength Estimation (USENIX Security 2016) — pattern matching plus a search for the cheapest decomposition. Hash rates are hashcat benchmark figures for an NVIDIA RTX 4090. Two honest caveats. First, the bundled dictionary here is a curated set of about a thousand common passwords, English words and names, not the tens of thousands zxcvbn ships; the breach-corpus check exists to cover what the dictionary misses. Second, all crack-time figures assume an offline attack against a stolen hash database. Against a live login form with working rate limits, even a mediocre password survives for years — which is exactly why reused passwords are so dangerous: they turn one site’s breach into an attack on all the others.
Need a password rather than a verdict? The Password Generator builds one with cryptographically secure randomness. If you are worried about where your details have already leaked, the Breach Directory & Exposure Timeline shows what each known breach exposed and what to do about each data class. Browse every Security & Privacy tool for more.
Frequently Asked Questions
How long should a password be in 2026?
For a site that stores passwords properly with bcrypt or Argon2, a genuinely random 12-character password is already beyond reach of any realistic attacker. For a site that might be using a fast unsalted hash like MD5 or SHA-1, aim for 16 or more, or use a four-to-five-word random passphrase. Length beats complexity: adding a character multiplies the search space far more than swapping an "a" for an "@".
Is it safe to type my real password into a strength checker?
Into most of them, no. This one analyses the password entirely in your browser using JavaScript, so it is never transmitted, logged or stored. The one network call it makes sends the first five characters of the password's SHA-1 hash — a bucket shared by roughly 800 different hashes — and matches the rest locally, which is the k-anonymity model Have I Been Pwned designed for exactly this purpose. Even so, the safest habit is to test a password you are considering rather than one you already use.
Why do two passwords the same length get wildly different crack times?
Because attackers do not brute force character by character; they guess in order of likelihood. "Summer2024!" and "vT7#qLm2Rz@x" are both twelve characters, but the first decomposes into a common word, a recent year and a symbol, so a rule-based attack reaches it within a few million guesses. The second has no structure to exploit, so it costs the full search space. This tool prices the cheapest decomposition a cracker could use, not the naive character count.
What does it mean if my password appears in the breach corpus?
It means that exact string has appeared in a publicly known data breach, so it is already in every serious cracking wordlist and will be tried within the first few thousand guesses regardless of how complex it looks. Change it everywhere you have used it. A count in the millions usually means it is a common human choice; a count of one still means it is burned.
Does adding a symbol at the end actually help?
Barely. Cracking rigs run rule sets that append digits, years and punctuation to dictionary words automatically, so "password!" costs a rule-based attacker only slightly more than "password". What genuinely helps is unpredictability across the whole string: more words, chosen randomly, with no relationship to you. If you are choosing by hand rather than with a generator, you are almost certainly less random than you feel — which is exactly why a corpus check matters.
