Password Strength Checker

Common password mistakes to avoid

• Using personal information — birthdays, names, phone numbers are guessable from social media and tried first in targeted attacks.
• Simple substitutions — “P@ssw0rd” is well-known to crackers. Dictionary attacks now include common substitutions (a→@, o→0, i→1).
• Reusing passwords — when one site is breached, attackers try the same password on other sites (credential stuffing).
• Short passwords — an 8-character password with only letters can be cracked in seconds with modern hardware.

The 2025 password guide

These recommendations are informed by NIST's SP 800-63B Digital Identity Guidelines (the 800-63-4 edition), which emphasize length over forced complexity, rule out scheduled password changes, and expect new passwords to be checked against known-breach lists. NIST requires at least 15 characters when a password is the only login factor and at least 8 when it is used with another factor; the advice below is stricter than that minimum.

• Minimum 12 characters; 16+ for important accounts
• Use a password manager — never reuse passwords
• Enable two-factor authentication (2FA) wherever possible
• Use hardware security keys (YubiKey) for critical accounts
• Check if your email/password appeared in known breaches at Have I Been Pwned

How crack time is estimated

The estimated crack time shown is based on an offline brute-force attack using a modern GPU (approximately 10 billion guesses per second). The calculation considers the size of the character pool you use — lowercase only (26), mixed case (52), alphanumeric (62), or with symbols (94) — raised to the power of your password length. A 10-character password using all character types has 94^10 ≈ 5.4 × 10^19 combinations (about 54 quintillion). At 10 billion guesses per second, trying every one takes about 171 years, which the tool shows as "Centuries+". A 16-character all-types password takes about 1.2 × 10^14 years (roughly 117 trillion).

Why your password still matters even with 2FA

Two-factor authentication is a strong second layer, but it doesn't make your password irrelevant. A weak password is more likely to be included in credential stuffing lists from previous breaches — attackers try known password/email pairs before attempting brute force. SMS-based 2FA can also be bypassed via SIM swapping. A strong, unique password combined with app-based 2FA (Google Authenticator, Authy) or a hardware key gives the best protection for high-value accounts like banking, email, and investment platforms.

Passphrase vs random string — which is better?

A random 12-character string like k#9Lm$2pQx!v has very high entropy but is nearly impossible to memorise. A 5-word passphrase like correct-horse-battery-staple-rain is easier to remember and has comparable entropy (5 words from a 2,000-word list = 2000^5 combinations). For accounts where you must type the password manually (computer login), passphrases win. For everything else, use a password manager with auto-generated random strings.