Skip to main content
PPenTesting.org

Password strength & crack-time

Type a password to see a strength score and roughly how long it would take to crack under five kinds of attack, with the reason it scored that way. It is checked in your browser and is not sent anywhere. Do not test a password you use for a real account.

Checked entirely in your browser. Your password is never sent anywhere, logged, or stored. Still, don't test a password you actively use on other sites.
Loading checker…

This is an estimate. It uses the open-source zxcvbn-ts library to look for the patterns attackers try first: common passwords and words (including swaps like a to @ or o to 0), keyboard walks, sequences, repeats, years and dates. Bits shown are log₂ of the estimated number of guesses. Guess rates are stated assumptions (see the table notes), not measurements. A determined attacker with a good wordlist and rules may crack a “reasonable” password faster than shown — treat these as a guide, not a guarantee.

Online, rate-limited10 a secondOnline, no limit1,000 a secondOffline, bcrypt10,000 a secondOffline, SHA-256 GPU10 billion a secondOffline, MD5 GPU rig100 billion a second
Same password, very different outcomes. The bars are log-scale: each step right is ten times faster.

What actually makes a password strong

  • Length beats complexity. Each extra character multiplies the work far more than swapping a letter for a symbol. A long passphrase usually beats a short cryptic string.
  • Uniqueness matters most. A password reused across sites is only as safe as the weakest site that stores it. Breached-credential reuse is the number-one way accounts fall.
  • Randomness beats patterns. Words, dates, and keyboard walks are in every wordlist. Generated random strings are not.
  • Storage decides the outcome. Even a great password is at risk if the service hashes it with fast, unsalted MD5. That is a system-side finding, not a user error.

Password strength, explained

How is password strength calculated?

It uses the open-source zxcvbn-ts library to find the cheapest way an attacker would guess the password: common passwords and words (including swaps such as a to @ or o to 0), keyboard walks, sequences, repeats, years and dates. The number of guesses that takes becomes the strength score, so Summer2024! rates as weak even though it has capitals, digits and a symbol.

How are the crack times worked out?

For each attacker scenario we assume a guessing rate (shown in the table) and divide the average number of guesses — half the keyspace — by that rate. The scenarios range from a rate-limited login at about 10 guesses a second to a multi-GPU rig against fast, unsalted hashing at around 100 billion a second.

Why do the same passwords crack instantly in one column and take years in another?

Because the attack model matters far more than the password alone. A strong password behind slow, salted hashing (bcrypt) can be safe for years, while the same password behind fast, unsalted MD5 in a stolen database can fall in hours. That gap is why how a system stores passwords is as important as how users choose them.

Is my password sent anywhere?

No. The entire calculation runs in your browser in JavaScript. Nothing you type is transmitted, logged, or stored. As good practice, avoid testing a password you currently use elsewhere.

Can this replace a password manager?

Use it as a guide, not a guarantee. The estimate cannot know your personal details and can be optimistic against an attacker with a tailored wordlist. The strongest practical advice is unchanged: use a password manager to generate long, unique, random passwords for every account, and enable multi-factor authentication.

How to read the crack times

  • Read the offline columns, not just the first. A rate-limited online login flatters every password. The offline fast-hash rows show what happens after a database leak with weak hashing.
  • Look at the warning, not just the score. It names the pattern that made the password cheap to guess: a common word, a year, a keyboard walk or a repeat.
  • Treat the time as an estimate. It assumes the attacker has no personal details about you.
SummerA common word2024A recent year!The usual symbol
Three chunks, each one a guess a cracking tool tries early. The composition rules are met; the strength is not.

What current official guidance says

Length and a blocklist matter more than symbols. NIST's digital identity guidelines say so directly:

“Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.”

“Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.”

That is why a long passphrase of unrelated words can score better than Summer2024!, which has a capital, a digit and a symbol but follows a pattern every cracking tool tries first.

Common password mistakes

  • Reusing one password. One breach then opens every account that shares it.
  • Swapping letters for symbols. a to @ and o to 0 are in every cracking wordlist.
  • Adding the year. Seasons plus years are among the first guesses.

If you run a system that stores passwords, check how they are hashed with the hash identifier. Fast hashes like plain MD5 undo the strength of a good password.

Related tools and guides

Hash identifierFind out what type a hash is.JWT decoderRead a token header and claims in your browser.Email security checkerCheck SPF, DKIM and DMARC for a domain.Penetration testing servicesWhat a test covers and what to ask for before you buy.How to choose a penetration testing companyA buyer checklist for comparing UK providers.

Is your app storing passwords safely?

Password storage and account-lockout controls are things a penetration test can check. Compare UK penetration testing companies in our directory.

Browse the directory