Password Strength Checker

What the checker recognizes

• common passwords from public leaks: 123456, qwerty, iloveyou;
• dictionary words, names, and cities in Russian and English;
• a Russian word typed on an English keyboard layout: ghbdtn, gfhjkm;
• the same in transliteration: privet, parol, lyubov;
• keyboard patterns: qwerty, йцукен, qazwsx;
• sequences and repeats: 12345, abcde, abcabc;
• years and dates: 1990, 01011990;
• character substitutions: p@ssw0rd reads as password.

The dictionary covers common passwords and frequent words, not the entire language. A rare word slips through and counts as a random string of characters, so the score comes out higher than it should.

Four cracking times

One number is not enough: a password for an email account and a password in a database that has already leaked are cracked at very different speeds. So the tool shows the time for four scenarios, from a login form that limits attempts to brute force on a GPU against a fast hash.

The password level reflects the worst of them. "Very weak" means that once the database leaks, the password is found within a second; "strong" means brute force takes more than a hundred years. The speeds are stated as assumptions and are listed right under the table: the exact number depends on which hash protects the database.

Getting a new password

Still, do not check other people's passwords, or your banking passwords, on any website: the habit of typing them wherever you like is more dangerous than a weak password.

If you need a new one, the password generator is right next to it: it builds a random string and shows its strength right away.