Skip to main content

password-strength-checker

A password strength checker analyses a password against dictionaries, common patterns, keyboard walks, and date sequences — returning entropy in bits, an estimated cracking time at offline-attack speeds, and concrete suggestions to improve the password (longer, less predictable, fewer repeated patterns). The ZTools Password Strength Checker uses Dropbox's zxcvbn algorithm, the de facto industry standard, runs entirely in the browser (so the password never leaves your device), and gives a 0–4 score plus actionable feedback rather than the misleading "must contain a special character" theatre that does not actually measure strength.

Use cases​

Setting your own master password​

Picking a password manager master password matters. Test before locking it in; aim for score 4 + 80+ bits entropy + "centuries" estimated crack time.

Form-side strength meter​

Sign-up forms guide users to stronger passwords. Embed zxcvbn-style feedback so users see why "Summer2026!" is weak — it matches a known pattern.

Audit company passwords during training​

In a security training session, demonstrate why dictionary-based passwords fall in seconds. Use synthetic examples (never real shared ones).

Checking a leaked password​

After a breach notice, test whether your replacement password is dramatically stronger than the old one. (Tip: also check at haveibeenpwned for known leaks.)

How it works​

  1. Type the password — Local-only field; password never sent anywhere. Keyboard input updates strength feedback live.
  2. zxcvbn analysis — Dictionary lookup (English + L33t variants), keyboard-walk detection, repeat / sequence detection, year detection.
  3. Read the score — 0 (terrible) to 4 (great). Plus entropy bits and estimated crack time at modern offline-attack speeds (~10 billion guesses/sec).
  4. Read suggestions — Concrete fixes: "add 3 more characters", "avoid common words", "do not end in a year".
  5. Improve and re-test — Iterate until score 4 and entropy ≥ 70 bits for a genuine master password.

Examples​

Input: Password123

Output: score=0, entropy=8 bits, crack_time=instant, suggestion="too common"

Input: correct horse battery staple

Output: score=4, entropy=44 bits, crack_time=centuries (4 random common words)

Input: Tr0ub4dor&3

Output: score=2, entropy=29 bits, crack_time=1 day (predictable substitution pattern)

Frequently asked questions​

Why does my "complex" password score low?

zxcvbn detects substitutions (a→@, o→0, etc.) and patterns (Capitalized + year + symbol). "Tr0ub4dor&3" looks complex but matches a known generation pattern, so attackers crack it quickly.

What is a good entropy target?

60+ bits for individual accounts, 80+ for master passwords or anything protecting many accounts. Each bit doubles the cracking time.

Are passphrases better than passwords?

Generally yes — 4 random common words ("correct horse battery staple") beats a typical 8-character password by orders of magnitude in both entropy and memorability.

Is the password sent to a server?

No. zxcvbn runs entirely in JavaScript in your browser. The password never crosses a network.

Should I rely on score 4 alone?

Score 4 is necessary but not sufficient. Also: never reuse passwords across sites, enable 2FA where available, store in a password manager.

What about quantum cracking?

Symmetric-key brute force is hardly affected by quantum (Grover gives a square-root speedup). 80+ bits remains safe for the foreseeable future. Asymmetric keys (RSA, ECC) are the ones at quantum risk.

Tips​

  • Aim for passphrases of 4+ random common words plus one number / symbol — high entropy, easy to remember.
  • Never reuse a master password anywhere else.
  • Use a password manager to generate and store per-site unique passwords; only one master needs human memorisation.
  • Add 2FA on every account that supports it — even a strong password is one breach away from leaking.
  • Re-check master password strength annually as cracking hardware improves.

Try it now​

The full password-strength-checker runs in your browser at https://ztools.zaions.com/password-strength-checker — no signup, no upload, no data leaves your device.

Open the tool ↗

Last updated: 2026-05-05 · Author: Ahsan Mahmood · Edit this page on GitHub