DevBentoPassword Strength Analyzer
Analyze password strength with entropy calculations, crack time estimates, pattern detection, and Have I Been Pwned breach checking. Powered by zxcvbn.
Password Strength Analyzer
Enter any password and get an instant strength analysis powered by zxcvbn. The tool evaluates dictionary patterns, keyboard sequences, character repetition, and common substitutions to give you an accurate score from 0 to 4. It also estimates crack times for four different attack scenarios and checks against the Have I Been Pwned breach database.
How to Use
- Type or paste a password into the input field
- Click the Show button if you want to see the password as you type
- Review the strength meter, crack time estimates, and detected patterns
- Click “Check if compromised” to verify against known data breaches
What the Scores Mean
| Score | Label | What It Means |
|---|---|---|
| 0 | Very Weak | Easily guessed. Common word, short, or simple pattern. |
| 1 | Weak | Some complexity but still vulnerable to targeted attacks. |
| 2 | Fair | Moderate strength. Adequate for low-risk accounts. |
| 3 | Strong | Good resistance against most attack methods. |
| 4 | Very Strong | Excellent. Would take centuries to brute-force with current hardware. |
Common Use Cases
Checking credentials before deployment
When building authentication systems, test sample passwords to verify your strength requirements are reasonable. If your minimum password policy produces scores below 2, it is too lenient.
Auditing existing passwords
If you reuse passwords across services, paste them into the analyzer to see how they hold up. The breach check will tell you if they have appeared in known data leaks.
Teaching secure password habits
Use the analyzer to demonstrate why “password123” scores 0 while “correct-horse-battery-staple” scores 4. The pattern detection shows exactly which weaknesses zxcvbn finds. See the Strong Password example to view a high-entropy passphrase analysis.
Understanding Crack Time Estimates
The tool shows four different scenarios:
- Offline slow hash (bcrypt/argon2): How long with realistic password storage. This is the most important metric.
- Offline fast hash (MD5/SHA): How long with unsalted hashes. Relevant for legacy systems.
- Online throttled (rate-limited login): How long with 100 attempts per hour.
- Online unthrottled (no rate limiting): Worst case for unprotected endpoints.
A password that takes “centuries” offline but “minutes” online highlights why rate limiting matters as much as password strength.
Related Tools
- Password Generator - Create random passwords with configurable character sets
- Hash Generator - Hash passwords with bcrypt, SHA-256, or other algorithms
Nothing you paste leaves this tab. Every tool runs entirely in your browser — no upload, no server, no account.