Free tool · passwords
How long would your password hold?
Type a password to see how long it would take to guess — from a website that limits attempts to a leaked database attacked with graphics cards. It is analysed on this page and never sent.
Runs in your browser · no account · nothing uploaded
0 characters · analysed on this device, never sent
Add what an attacker might know about you
Separated by commas or spaces. A password built from them is guessed first.
Four attacks, four speeds
Online, rate-limited
A website that slows down or blocks repeated sign-in attempts: 100 guesses per hour.
—
Online, no rate limit
A careless website that lets an attacker try as fast as it answers: 10 guesses per second.
—
Offline, slow hash
A stolen database protected by bcrypt, scrypt or Argon2: 10,000 guesses per second.
—
Offline, fast hash
A stolen database hashed with MD5 or SHA-1, attacked with GPUs: 10 billion guesses per second.
—
Good to know
- How is the time estimated?
- The password is analysed the way attackers guess: leaked passwords first, then English and French words, first names and last names, dates, keyboard patterns, repetitions and look-alike substitutions such as “p@ssw0rd”. That gives the number of guesses needed (with zxcvbn), divided by the speed of each attack.
- Why four different times?
- It depends on how the password is attacked. A website that limits sign-in attempts lets an attacker try about a hundred times an hour. A stolen database is attacked offline, as fast as the hardware allows: thousands of guesses per second against a slow hash like bcrypt or Argon2, billions against MD5 or SHA-1.
- Is my password sent anywhere?
- No. The analysis runs entirely on this page: nothing is sent or stored. Even so, it is good practice to test a password of the same kind rather than the one you actually use.
- What makes a password strong?
- Length and unpredictability. Five or six random words, or a random string from a password manager, beat any clever substitution. And one password per site: a strong password reused elsewhere falls with the weakest site that stores it.