Create a strong passphrase you can actually remember, or check how long a password would hold out against a real attacker. Everything happens on your device.
The estimate uses zxcvbn, which looks for common passwords, names, words, dates, keyboard patterns and substitutions such as “p@ssw0rd”. It does not know whether a password has appeared in a data breach; real attackers try leaked passwords first, so never reuse one.
Checked in your browser. Nothing is sent or saved.Each word from the 7,776-word EFF list adds about 12.9 bits. Six words (about 77 bits) suit important accounts and the master password for a password manager. Five words (about 65 bits) suit everyday accounts, which limit how fast anyone can guess. Adding capitals, numbers or symbols helps far less than adding one more word.
Strength comes from how many possibilities an attacker has to work through, not from how odd a password looks. People pick predictable “complex” passwords, such as a word with a capital at the start and a number and symbol at the end, and attackers try those patterns first. Six truly random words have more possibilities than a random 12-character password and are far easier to remember and type.
Every word and character is chosen with your browser's cryptographic random number generator (crypto.getRandomValues), with no bias towards any choice. The bits shown assume the attacker knows exactly how the passphrase was made, so they are a cautious figure.
This checker sends nothing. You can confirm it in your browser's network tools, or by going offline before you type. As a habit, it is still wiser to test a password that follows the same pattern as your real one, and to be wary of any website that asks for your actual password.
They show the average time to guess the password at four speeds. Websites that limit sign-in attempts allow only a handful of guesses. If a website's password database is stolen, attackers guess offline: billions a second if the site stored passwords with a fast hash, thousands a second if it used a slow, purpose-built one. You cannot know how a site stores your password, so plan for the fastest case.