An upper bound on how strong a password is, from the patterns that actually make one guessable, with the model and its limits stated in full.
Initializing in your browser…
Generate passwords from the Web Crypto generator by rejection sampling, with the entropy stated exactly from the alphabet, the cost of every rule computed, and crack times against four named attacker models
Check a link for typosquats, brand-in-subdomain tricks, mixed-alphabet homographs, and hidden destinations. Public Suffix List parsing, explainable per-rule scoring, and the link is never fetched.
Read the certificate chain a server sends and say whether it is complete, in order and in date, and build the OpenSSL commands that fetch it.
Your password policy demands twelve characters with upper case, lower case, a digit and a symbol. Somebody picks Password123!, which satisfies every part of it.
Typed
Password123!
What each model makes of it
A character-class meter 79 bits "Strong" This tool 13.8 bits "Very weak" How the model reads it: "Password123" breach list number 37 on the published lists "!" no pattern found How long that takes to guess: Online, rate limited 1 minute Offline, bcrypt at cost 12 instantly Offline, PBKDF2 at 600,000 instantly Offline, a single fast hash instantly
Both numbers are computed correctly. They answer different questions.
79 bits is what you get from twelve characters times the base-two logarithm of a 94-character alphabet, and it is exactly right for a password a generator drew uniformly from that alphabet. Password123! was not drawn uniformly from anything. It is number 37 on the published breach lists, so an attacker working down that list reaches it in about thirty-seven guesses, and the trailing exclamation mark is the only part doing any work at all.
That is why the second number is labelled "at most". The strength of a password a person chose depends on how they chose it, which nobody can observe, so it can only be bounded from above: a model can prove a password is weak by finding a cheap way to guess it, and can never prove one is strong. 13.8 bits means the model found a way in; it does not mean there is no cheaper way it missed.
The test that this works is not the number but a comparison, and the project tests make it directly against the real page: two passwords of the same length with the same character classes, one with a pattern and one without. A class-counting meter scores both identically. Here aaaaaaaaaaaa is 8.3 bits and xkvmqzrtbwnj is 56.4; 123456789012 is 7.5 and 849205173648 is 29.5. The crack times carry their rate because a crack time without one means nothing, and the four attacker models are the same ones the password generator uses, so the two tools cannot disagree about what an attacker can do.
Most strength meters count character classes: they multiply the length by the logarithm of the alphabet and call the result entropy. That is exactly right for a password a generator made and close to meaningless for one a person chose. This tool looks for the patterns that actually make a password guessable and reports an upper bound, with the model written out and its limits stated.
The entropy of a generated password is known: length times the log of the alphabet, exactly, because the generator drew uniformly. The entropy of a password a person chose is a property of how they chose it, which nobody can observe. It can only be estimated, and only ever from above: a model can prove a password is weak by finding a cheap way to guess it, and it can never prove one is strong. Every number here is therefore an upper bound, and the page says "at most" beside it rather than presenting it as a measurement.
What that changes is which passwords get called strong. Password123! has twelve characters and four character classes, so a class-counting meter calls it 79 bits and rates it Strong; it is on the first page of every published breach list. This tool decomposes it into the breach-list entry and what is left, and reports 13.8 bits. Tr0ub4dor&3, the xkcd 936 example, is 72 bits to a class counter and 34.6 here once the leet substitutions are undone. The comparison is shown on screen with both numbers, so the disagreement with every other meter is visible rather than confusing.
The model finds the passwords that top the published breach lists, ranked so the rank is the number of guesses; common English words; runs along a keyboard on its rows and its columns, in either direction, on QWERTY, AZERTY and QWERTZ; alphabetic and numeric sequences at any step, ascending or descending; repeats of a character or of a block; dates and years, which are the commonest thing a person appends; and the leet substitutions every cracking rule tries first, so P@ssw0rd is scored as password plus the cost of two substitutions rather than as eight random characters. It then finds the cheapest way to build the whole password out of those pieces, the way zxcvbn established, and shows you the decomposition it used.
The test for whether that works is not a number but a comparison, and the project tests make it directly: take two passwords of the same length using the same character classes, one with a pattern and one without. A class-counting meter gives both the same score. Here, aaaaaaaaaaaa scores 8.3 bits and xkvmqzrtbwnj scores 56.4; 123456789012 scores 7.5 and 849205173648 scores 29.5; qwertyuiopas scores 15.2 and zxmbvnclkjhg scores 44.2.
Crack times come with their rate attached, because a crack time without one is meaningless: four named attacker models, from a rate-limited login at a hundred guesses a second to a stolen database hashed with a single round of SHA-256 at a hundred billion. They are the same four the password generator uses, so the two tools cannot disagree about what an attacker can do.
What the model does not know is stated on the page next to the result rather than buried: the word lists here are small, a few hundred entries against the millions a real attacker uses in every language; nothing here knows your name, your employer or a date that matters to you, so a password this model calls strong may be one guess for somebody who does; and a password with no recognised pattern is reported as having none, which is the best the model can say and is not proof that it is random. The password is typed into the page and goes nowhere: not to a server, not into the address bar, not into history.
The safest password to type into any checker is one you are about to replace. The decomposition shows exactly why the old one was weak.
Password123! satisfies every common rule and is on the first page of every breach list. The two numbers side by side make the point without an argument.
Two passwords of the same length and the same character classes can differ by fifty bits. A class-counting meter cannot tell you which.
Because most meters count character classes and nothing else. That number is right for a generated password and close to meaningless for a chosen one: it gives the same score to aaaaaaaaaaaa and to twelve random lowercase letters. This tool looks at what the characters actually are.
Because the strength of a chosen password depends on how it was chosen, which cannot be observed. A model can prove weakness by finding a cheap way to guess, and can never prove strength. So the honest reading is "no stronger than this", never "this strong".
It means this model found no pattern it knows about, which is the best it can say. The word lists here are small, they are English only, and nothing here knows your name, your employer or your dates. A password built from those may be one guess for somebody who knows them, and full strength to this model.
It stays in the page: it is not sent anywhere, not written into the address bar or history, and not stored. That said, the safest password to type into any checker anywhere is one you are about to change.
Because a crack time depends entirely on how the password is stored at the other end, and that is not something you control. A rate-limited login allows a hundred guesses a second; a database hashed with one round of SHA-256 allows a hundred billion. Both are shown, with the assumption named.
It is the cheapest way the model found to build your password out of things it recognises. Each part shows what it is and what reaching it costs an attacker; the parts marked as having no pattern are the only ones being treated as unguessable.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.