Play
Password Strength Lab
Type a password and see roughly how long it would survive a real attacker, plus what gives it away. (Please don’t test your actual bank password anywhere, including here. Test something like it.)
How to use: type a throwaway password. Nothing leaves the page.
(stolen MD5/NTLM dump, GPU rig at 10 billion guesses/sec)–
(properly salted bcrypt, ~10,000 guesses/sec)–
(login page with rate limiting, ~100 guesses/hour)–
- Go on, type something. I promise I won’t tell anyone. I literally can’t.
How it works: the lab splits your password into the cheapest pieces an attacker would guess (a ~100-entry common-password list, a sample English word list, keyboard walks, sequences, repeats, years and dates, with leetspeak undone) and brute-forces the rest. It’s a rough estimate in the spirit of zxcvbn, not a guarantee. Real attackers also use breach lists, which this page deliberately never checks because that would need the network. NIST SP 800-63B favors length and breached-password screening over composition rules: a long passphrase in a password manager, plus MFA, beats P@ssw0rd! every time.