Check Password Strength with a Realistic zxcvbn Score
Most password strength meters are theater: they count length and character variety and hand out a green bar for Password123!. This checker takes a different approach. It runs zxcvbn, the password strength estimator built on real-world breach data, which evaluates a password the way an actual attacker would: by looking for dictionary words, common patterns, keyboard sequences, repeated characters, and known leaked passwords. The result is a score from 0 to 4 plus a practical estimate of how long a determined attacker would need to crack the password offline.
How to Check a Password
- Type or paste a candidate password into the input field. The analysis runs live on every keystroke, so there is no submit button to press.
- Read the score, which ranges from 0 (very weak) to 4 (very strong), along with the matching label such as risky, weak, fair, strong, or excellent.
- Review the crack-time estimate, which tells you how long an offline attacker with a powerful machine would likely need.
- Inspect the feedback section for specific problems, such as a common word, a repeated pattern, or a sequence that is easy to guess.
- Improve the password using the suggestions, then watch the score climb in real time as you edit.
- Run the same check on passwords you already use to find the weakest links in your accounts.
Example Input and Output
Consider what happens when you check a dictionary-based password against one built from random words. The first looks strong at a glance but scores poorly, while the second survives the analysis.
| Input | Output |
|---|---|
Password123! | score 0 (risky), cracked in seconds |
correct-horse-battery-staple | score 4 (excellent), centuries to crack |
Tips for a Higher Score
- Mix random words — four unrelated words joined by separators score far higher than a single word with digits tacked on.
- Avoid keyboard walks —
qwertyandasdfare among the first patterns zxcvbn and attackers try. - Do not pad with years — appending
2024to a word adds almost no strength because it is a predictable pattern. - Check with a password manager — run generated passwords through this checker once to confirm they reach a score of 4.
When to Use This Tool
- Before changing a password — verify the new one actually improves on the old before you commit to it.
- Auditing existing accounts — test your current passwords and prioritize changing any that score 1 or below.
- Educating users — show teammates or family members why their current password fails and what a strong alternative looks like.
Frequently Asked Questions
What does the zxcvbn score mean?
The score runs from 0 to 4. A score of 0 means the password is trivially guessable, 1 is very guessable, 2 is somewhat guessable, 3 is safely unguessable, and 4 is very unguessable. Anything below 3 should be replaced.
Is my password sent to a server for checking?
No. zxcvbn runs entirely in your browser. The password never leaves your device, which is exactly why you can safely check real passwords with this tool.
Why is my password weak even though it has symbols?
zxcvbn ignores superficial complexity. If the core of the password is a dictionary word or a pattern, symbols and digits around it do little to help. An attacker guesses the pattern, not each character.
What is the crack-time estimate based on?
It models an offline attacker with a powerful machine guessing at a rate of about ten billion attempts per second, the realistic speed for a modern GPU cracking a fast hash. Online login attempts are far slower.
Does the checker know about breached passwords?
zcvbn ships with a built-in list of the most common passwords and patterns from real breach data. It flags entries like 123456, password, and letmein immediately.
What is the strongest type of password?
A long, randomly generated string, or a passphrase of four or more unrelated random words. Both score 4, and both are far more practical than a short jumble of symbols.
Should I aim for a score of 4 on every account?
Yes, especially for email, banking, and cloud storage, because those accounts can reset or expose everything else. A score of 3 is acceptable for low-value accounts.
Why does my old password score better than my new one?
Length and unpredictability matter more than character variety. If the new password is shorter or built from a recognizable word, it can genuinely score lower. Use the feedback to fix it.