Password strength checker: how long would it take to guess?

Most password meters count character types: a capital, a number, a symbol, done. Attackers do not guess that way. They try leaked passwords, dictionary words, names, years and keyboard patterns first, with every common trick applied. This password strength checker estimates strength the way an attacker would guess, and tells you what makes a password weak.

How to use the password strength checker

1. Type or paste a password into the Password box. Tick Show the password to see what you typed.
2. Read the strength bar, the estimated bits, and the two guessing times.
3. Read the notes under it: they name the common password, word, keyboard run, sequence, repeat or year the checker found.
4. Optional: press Check data breaches to find out if the exact password appears in known breaches.

Everything except the breach check happens on your computer as you type. The page loads two word lists once, to recognize common passwords and words.

How the estimate works

The checker looks for the cheapest way to guess your password, piece by piece. A piece can be:

• A common password, from a list of the 10,000 most common ones, such as dragon or iloveyou.
• A dictionary word, from a list of 7,776 English words, also with letters swapped for look-alikes such as @ for a or 0 for o.
• A keyboard run along a row, such as qwerty, asdf or zxcvbn, on common keyboard layouts.
• A sequence such as abcd or 9876.
• A repeat such as aaaa or abcabc.
• A year or a date, from 1900 to 2039.
• A single character, when nothing else fits.

The checker adds up how many guesses each piece takes and picks the split that needs the fewest. That number, in bits, is the strength. The idea comes from zxcvbn, the open-source estimator Dropbox published in 2012; this checker is a smaller version of the same approach, built to run without any other code.

What the guessing times mean

The tool shows two times, because attacks come in two kinds:

• Online, with limits. Someone tries passwords on the website's sign-in page. Websites slow this down and lock accounts, so we assume 100 guesses an hour. Only very weak passwords fall this way.
• Fast offline attack. A website's password database leaks, and the attacker guesses against the stolen copies on their own hardware. We assume 10 billion guesses a second, which fast hardware can reach against weakly protected databases. A password that holds for centuries here is strong.

Both times are estimates of the average case: an attacker finds the password halfway through. They are useful for comparing passwords, not as promises.

The data breach check, and why it is private

Have I Been Pwned, run by security researcher Troy Hunt, collects passwords from real data breaches. Its Pwned Passwords service is built so you can check a password without revealing it:

1. Your browser turns the password into a SHA-1 hash, a fixed 40-character fingerprint.
2. It sends only the first 5 characters of that fingerprint.
3. The service answers with every breached fingerprint that starts with those 5 characters, hundreds of them, plus padding so the answer's size reveals nothing.
4. Your browser looks for the rest of your fingerprint in that list.

The password, and even its full fingerprint, never leave your computer. This method is called k-anonymity. Barside's built-in password manager uses the same service, the same way, when you turn on its leak check.

How to fix a weak password

• Make it longer. Length beats every trick. Go for 16 random characters, or 6 random words.
• Let a generator choose. Use the password generator for accounts your password manager fills, and the passphrase generator for passwords you type.
• Never reuse it. One breached password should open one account, not ten.
• Store it in a password manager. Then strong and different passwords cost you nothing to remember. Compare options in our 1Password alternative guide.

Credits

Common passwords come from SecLists by Daniel Miessler (MIT License). Dictionary words come from the EFF Long Wordlist (Creative Commons Attribution). Breach data comes from Pwned Passwords by Have I Been Pwned (CC BY 4.0).