About this tool
Many password checkers only count length and character types. Attackers do not guess blindly, though: they try leaked passwords, words, years and keyboard patterns first. “Summer2024!” passes every usual password rule and still falls in seconds.
This checker therefore breaks the password into patterns: frequently leaked passwords (also in leetspeak like “P4ssw0rd”), German and English words, sequences like “abc” or “123”, keyboard patterns like “qwerty”, repeats and years. From an attacker’s cheapest path it calculates the entropy and the crack time for three typical attacks.
The check runs entirely in your browser. Only if you click “Check data breaches” are the first 5 characters of the SHA-1 hash sent to Have I Been Pwned. Your password itself cannot be derived from them.
How it works
- Type the password into the field. “Show” reveals it in plain text along with the patterns found.
- Read the strength, entropy and crack times for an online attack, a slow and a fast hash.
- Review the patterns found and change the password until no warnings are left.
- Click “Check data breaches” to see whether the password already appears in known leaks.
Frequently asked questions
What do the bits of entropy mean?
They tell you how many guesses an attacker needs on average: every bit doubles the effort. Below 40 bits a password counts as weak here, from 60 bits as strong and from 80 bits as very strong. The value is an estimate, not an exact measurement.
Why are the crack times so different?
A login page only allows a few guesses per second. With a stolen database it depends on the hash: slow schemes like bcrypt or Argon2 allow a few thousand guesses per second, fast ones like MD5 on GPUs billions. Plan for the worst case.
Is it safe to enter my real password here?
The password is only evaluated in your browser and not stored, not even in the URL. For the breach check only 5 hex characters of the hash go to Have I Been Pwned, and they match hundreds of different passwords. To be completely sure, test a password with a similar structure.
My password was found in a data breach – now what?
Change it everywhere you use it and never use it again. Attackers try leaked passwords on many services. Create a new random password with the Password Generator, ideally a separate one per service in a password manager.
What does a strong password look like?
Long and random: about 16 random characters or a passphrase of five to six randomly chosen words. Self-made words with a number and symbol appended are easy to guess. 2FA adds another layer – you can test it with the TOTP / 2FA Code Generator.