How do I check whether my password is really strong?
Type a password and get a score 0-4 (from "Very weak" to "Very strong") plus a concrete WHY explanation.
Unlike a simple entropy meter, zxcvbn (the Dropbox library) detects patterns: dictionary words, birth years, keyboard walks (qwerty), repeats, leetspeak (P@ssw0rd), surnames.
Shows crack time across 4 scenarios (online with rate limiting, online without, offline against bcrypt, offline against MD5+GPU). Everything is local, the password never leaves the browser.
How to use it
- Type the password, the field is masked (dots). Click the eye icon to reveal.
- Read the result live, the color bar shows 0-4 (red→green).
- Check the "Detected patterns" section, zxcvbn shows WHICH part is a dictionary word, WHICH is a birth year, WHICH is a keyboard sequence.
- Apply the "Suggestions" from the library: "Add another word", "Avoid years", "Use mixed case". Each suggestion raises the score.
- Goal: score=4 ("Very strong") + no warnings. Offline-fast crack time >100 years = practically unbreakable.
When this is useful
Five typical situations where a strength rating saves you from disaster:
- Auditing your own passwords. Check every password from your manager, start with the weakest.
- Corporate policy. Test sample passwords against your rules; see whether "minimum 8 chars, uppercase, digit" actually yields strong passwords (usually not, zxcvbn will show "Summer2024!" is weak despite meeting the criteria).
- Team education. Prove that "a password I came up with off the top of my head" has 30 bits of entropy.
- New-hire onboarding. Vet the proposed temporary password before account creation.
- Passwords for external drives, ZIP archives, PGP keys. Every such password deserves a rigorous test, because it's never single-use.
After finding a weak password, generate a strong one and check it hasn't leaked.
Questions and answers
Entropy from `length × log2(charset)` assumes the password is RANDOM. Most human passwords are NOT random, "Summer2024!" looks like 11 chars = 67 bits, but it's actually a dictionary word + year + common suffix (~25 bits, cracked in hours). zxcvbn recognizes patterns and gives a realistic estimate. It runs against 30,000+ common passwords, dictionaries, dates, keyboard walks.