Password Strength Checker
See how strong a password really is: zxcvbn scoring, realistic crack-time estimates and concrete fixes — all computed locally, never uploaded.
Analyzed locally with the zxcvbn algorithm in your browser — the password is never sent anywhere.
This tool runs entirely in your browser. Your data never leaves your device — it is not uploaded to any server.
How to use
- 1Type or paste the password into the box — use Show if you want to read it.
- 2Watch the score meter move from Very weak to Very strong as you edit.
- 3Read the crack-time table to understand what it withstands: throttled online guessing, offline attacks against slow hashes and offline attacks against fast hashes.
- 4Apply the suggestions — usually adding a couple of random words is the fastest win.
Password Strength Checker
Most meters just count character classes. This checker runs the zxcvbn algorithm — built from real breach data and pattern analysis — which catches keyboard walks, repeated chunks, dates, l33t substitutions and passwords that appear in known leaks.
You get a 0–4 score, estimated crack times under three attack scenarios, and specific suggestions. Everything is computed in your browser: the password you type never leaves your device.
Frequently asked questions
What do the three crack-time scenarios mean?
They model different attackers. Online, throttled (100 guesses/hour) is a login form that limits attempts. Offline, slow hash assumes a database hashed with bcrypt and cracked at 10,000 guesses per second. Offline, fast hash assumes weak or unsalted MD5/SHA-1 hashes cracked on GPUs at billions of guesses per second — the worst case for any reused password.
Why does “Tr0ub4dor&3” score badly when it looks complex?
Because substitutions like 0 for o and 3 for e are the first thing cracking dictionaries try. zxcvbn models these l33t rules, so it rates the underlying pattern — “troubador” plus decoration — rather than being fooled by the symbols.
Is my password sent anywhere?
No. The zxcvbn libraries and dictionaries load into your browser and every calculation runs locally. No network request carries your input.
Related tools
Password Generator
Generate strong passwords and passphrases in your browser with live entropy estimates — crypto-grade randomness, nothing sent or stored.
All tools →
TOTP Generator
Generate 2FA codes offline from any TOTP secret — RFC 6238, 6 or 8 digits, live 30-second countdown. Your secret never leaves the browser.
All tools →
Hash Generator
Compute SHA-1, SHA-256, SHA-384, SHA-512 or MD5 hashes of text or files, right in your browser. Fast checksums for integrity checks — nothing uploaded.
All tools →
UUID Generator
Generate random UUID v4 identifiers in bulk with one click — 1 to 500 at a time, using your browser's cryptographic randomness. Free, instant, offline-capable.
All tools →
Embed this tool
Put this tool on your own site with one line — it runs entirely in the visitor's browser.
<iframe src="https://zoyku.com/en/tools/password-strength?embed=1" width="100%" height="640" style="border:0;border-radius:16px" title="Zoyku — password-strength" loading="lazy"></iframe>