Security Tools
Password GeneratorPassword Strength AnalyzerPassphrase Generator2FA / TOTP Code Generator

Password Strength Analyzer

See what an attacker sees in your password, whether it has leaked in a data breach, and how long it would take to crack.

Runs in your browserNo sign-up required
Try an example:
Add your name or email to catch personal details (optional)

Passwords built from your own name, birthday or email are among the first things attackers try. This stays on your device.

The strength check runs entirely in your browser. Nothing you type is saved or sent, apart from the 5-character hash prefix for the breach check, which you can turn off above.

A Strength Check That Thinks Like an Attacker

Most strength meters only count letters, numbers and symbols, so "Rahul@1995" looks strong. Real attackers start with leaked passwords, names, words, birth years and keyboard patterns, and this checker does the same. It shows which parts of your password are predictable, checks it against passwords exposed in real data breaches without sending the password anywhere, and gives realistic crack times with clear steps to fix it.

How to Use This Tool

  1. 1Type or paste the passwordThe check updates as you type. Use the eye button to show or hide it, or try one of the examples first.
  2. 2See what an attacker seesThe password is split into the parts cracking tools recognise: common words and names, leaked passwords, dates and years, keyboard patterns, and random characters.
  3. 3Check if it has leakedIt is compared safely against the Have I Been Pwned database of passwords exposed in data breaches.
  4. 4Read the crack times and fix itSee how long it would last against four kinds of attack, with clear tips, or generate a strong replacement in one click.

Good to Know

  • Strength isn't about having a symbol and a number. "Priya@1234" ticks every box on most sign-up forms but is guessed in seconds, because it is a name, a symbol and a sequence. Length and randomness matter far more.
  • The checker knows millions of leaked passwords, common words, first names and surnames (including common Indian names), dates, years and keyboard patterns like qwerty and 1qaz2wsx.
  • Parts it can't recognise are scored the way cracking tools guess them: each character by its type (lowercase, capital, digit or symbol). That makes the estimate realistic rather than optimistic.
  • The breach check uses k-anonymity: only the first 5 characters of your password's SHA-1 hash are sent. The service returns hundreds of possible matches and your browser checks them, so the password itself never leaves your device.

Frequently Asked Questions

Is it safe to type my real password here?

The strength check runs entirely in your browser and nothing is saved. The leaked-password check sends only the first 5 characters of a SHA-1 hash of the password to Have I Been Pwned, which can't be turned back into the password; you can also switch it off. As a habit, avoid typing live passwords into sites you don't trust.

How do I check if my password has been leaked?

Type it in with "Check leaked-password database" switched on. It is compared with hundreds of millions of passwords exposed in real data breaches. If it has been seen even once, stop using it everywhere: attackers try leaked passwords first.

What do the four crack times mean?

They show how long the password would last in different attacks: guessing on a website that locks you out after a few tries, a website with no limit, a stolen database stored with a slow, strong hash like bcrypt, and a stolen database with a fast, weak hash cracked on graphics cards (the worst case). Aim for at least centuries in the last one for important accounts.

Why is my long password still weak?

Length only helps if the characters are unpredictable. Names, dictionary words, years, keyboard runs and leaked passwords are tried first, whatever their length. "Sachin@1973" or "Mumbai#123456" look complex but follow patterns cracking tools try early.

What makes a password strong?

At least 12 to 16 characters that are random, or 4 to 6 random words joined together, used for one account only. A password manager makes this easy. Turn on two-factor authentication too, so a leaked password alone isn't enough.

How is this different from the Password Generator?

The Password Generator creates a new strong password for you. This tool checks a password you already have, or are thinking of using, and explains exactly what is weak about it.