Password Generator & Checker
Generate strong passwords and check strength
Want passphrases of random words, several at once, look-alike characters left out or the entropy maths? Use the Password Generator. This page is for checking a password you already have.
About Password Generator & Checker
Generates a secure random password and separately checks the strength of an existing password with a pattern-based estimator (it recognises common words, names, keyboard runs, repeats, dates and letter substitutions like p@ssw0rd, not just character types).
Use the generator to create a new password with your chosen length and character types, or paste an existing password into the checker to see its estimated strength.
A strength checker can only evaluate patterns, not whether a password has already been leaked in a data breach — using a unique password for every account matters at least as much as the password's raw complexity.
Watch: Password Generator & Checker in Action
- Does a strong password check mean my account is safe?
- Not entirely — a strength checker can only evaluate patterns, not whether a password has already been leaked in a data breach. Using a unique password for every account matters at least as much as the password's raw complexity.
- What is the crack time based on?
- The tool reports the library's offline slow-hashing scenario: an attacker with a stolen database and many guesses per second, against a password stored with a deliberately slow hash. It is a rough comparison figure, not a prediction for your account.
- How random is a generated password?
- Characters are picked with the browser's cryptographic random generator, using rejection sampling to avoid bias. If the length allows, the tool retries until each switched-on character type appears at least once.
- Why does a long password still score low?
- Length counts for less when the content follows a pattern. A repeated block, a keyboard run, a common word or a date is cheap to guess, so the estimator discounts it. The warning line under the bar names the pattern it found.
- Does it check whether my password has been leaked?
- No. It only recognizes patterns and common words inside its bundled lists, and it never contacts a breach database. A password can score Very strong and still be exposed if it was used somewhere that got breached.
- Is my whole password analyzed if it is very long?
- Only the first 100 characters are passed to the estimator, because the analysis gets slow on very long input. The rest of the text is ignored for scoring, but it stays in the box and is copied by the copy icon.
How to use Password Generator & Checker
There are two parts. In the Password box, type or paste an existing password. After a very short pause, a colored bar, a label running from Very weak through Weak, Fair and Strong up to Very strong, an estimated offline crack time, and any warning and suggestions appear beneath it. The copy icon next to the box copies whatever it holds.
To create a new one, use the Generate Password panel. Drag the Length slider between 4 and 64 (it starts at 16), switch Uppercase, Lowercase, Numbers and Symbols on or off, and press Generate. The result drops into the Password box and is scored like any typed password. Symbols come from the set !@#$%^&*()_+-=[]{}|;:,.<>? and if all four switches are off, Generate does nothing.
When to use it
Use it to find out whether a password you are tempted to keep builds on a dictionary word, a name, a keyboard run like qwerty, a repeated chunk or a date, since those are the patterns the checker looks for. It also suits producing a random password of a specific length when a site demands, say, only letters and digits, by switching Symbols off.
When not to use it
Do not rely on the score as a guarantee. It cannot know whether a password has appeared in a breach, whether you reuse it elsewhere, or how the target site stores it. For a master password, a passphrase from your password manager's own generator is a better route. Avoid testing an important live password on a shared or recorded screen, since the field shows the text in plain view.
Tips for best results
The estimate rests on how many guesses a pattern-aware attacker would need, so a long phrase of unrelated words can outscore a short string packed with symbols. Read the red warning line: it names the specific weakness, such as a common sequence or a repeat, and the suggestions list says what to change. Swapping an a for an at sign adds little, because those substitutions are recognized.
Limitations
The score is an estimate from a pattern-matching library, not a measurement. The crack time assumes an attacker holding a stolen database whose passwords were stored with a slow hash; an online login with rate limits would take far longer, and fast or unsalted hashing far less. Only the first 100 characters are analyzed. Generated passwords use only the four character sets listed, so look-alike characters cannot be excluded.
Privacy
Scoring runs the zxcvbn estimator and its word lists in your browser; the lists load as part of the site's own code, and the password you type is checked on your device and never posted. Generation uses your browser's cryptographic random number generator. Pressing Generate does make the site log the tool name and a device identifier, but not the generated or typed password.
More from Security & Developer: