Password Strength Checker

zxcvbn is a password-strength estimator written by Dan Wheeler at Dropbox in 2014. Unlike naive "1 number + 1 symbol" rules, it simulates real attacker strategies: known dictionaries, leetspeak substitutions, keyboard patterns, dates, repeats, and credential-database matches. It's now the gold standard used by 1Password, Bitwarden, and most security-conscious services.

Entropy (bits) is a mathematical measure of randomness - 60 bits means roughly 2^60 possible combinations. The zxcvbn score (0-4) is a practical estimate after factoring in known patterns, dictionaries, and substitutions, so a "60-bit" password can score lower if it follows predictable patterns. Both are useful: entropy for theoretical strength, score for real-world strength.

It assumes an offline attacker with a fast hardware setup - 100 billion guesses per second, which is what an 8-GPU cluster running Hashcat against unsalted MD5 can deliver. For salted bcrypt or Argon2, the rate is much slower, so the displayed crack time is conservative for properly-hashed passwords. For credential stuffing (online attacks), the rate is throttled to ~1000 guesses/second, where even a moderate password lasts decades.

For typical use: score 3 with 50+ bits of entropy. For high-value accounts (email, banking, password-manager master): score 4 with 65+ bits. The simplest way to hit either: a 4-word random passphrase (like the famous "correct horse battery staple" example) gives ~50 bits with 0 effort to memorize. Add a number or symbol for higher.

No - use this with a password manager. The manager generates and stores the password; this tool is for spot-checking the result, validating master passwords, and educating users. Never reuse passwords across sites; the manager makes that practical.

Because every password cracker in the world has it in their first 100 attempts. Common substitution patterns (a→@, o→0, i→1) plus a familiar word add zero security against modern dictionary attacks. The score reflects what a real attacker would do, not what a checkbox-only "complexity" rule would accept.