Check strength & generate secure passwords
Passwords fail in predictable ways. Attackers rarely sit guessing by hand — they run software that tries billions of combinations per second, starting with dictionaries of real words, common substitutions like "P@ssw0rd", keyboard patterns, and every password ever exposed in a breach. A password that feels clever to a human is often among the first few million guesses for a machine.
Two properties do nearly all the defensive work: length and randomness. Each extra character multiplies the search space enormously — a truly random 16-character password is not twice as strong as an 8-character one, it is trillions of times stronger. This checker scores your password against those factors and estimates realistic crack times, while the generator produces passwords using your browser’s cryptographically secure random source, the same quality of randomness used in encryption.
A word about trust, because typing a password into a website should make you pause: this page performs every check and generates every password locally in your browser. Nothing you type or generate is sent, logged, or stored anywhere — disconnect from the internet after loading the page and it works identically. That is a verifiable design choice, not a promise.
Yes — the analysis runs entirely in your browser and the password never leaves your device. You can verify this by loading the page, switching off your internet connection, and using the checker offline. That said, general good practice is to test the pattern of your passwords rather than your single most critical one.
Length first, then randomness. Fourteen or more characters drawn unpredictably from a large character set resists modern cracking hardware for longer than any human lifetime. Common words, names, dates, and substitutions like 0 for o add far less strength than they appear to, because cracking software tries all of them early.
Both can be excellent. A generated 16+ character random password is the strongest option per character and ideal inside a password manager. A passphrase of four or five genuinely random words is easier to memorise for the few passwords you must type by hand, like the manager’s own master password.
It is a modelled estimate assuming an attacker with modern GPU hardware attacking a properly stored password. Real timelines vary with the attacker’s resources and how the service stores passwords — treat the number as a comparative guide: days versus centuries is the signal that matters.
Because breaches happen constantly, and attackers immediately try every leaked email-password pair on other services — an attack called credential stuffing. A unique password confines the damage of any single breach to that one account. Pair this tool with our Breach Checker to see whether a password has already been exposed.