Crack-time estimates for real attack scenarios. Runs entirely in your browser; nothing you type leaves this page.
This never leaves your browser. The page makes no network requests with what you type; you can even load it, go offline, and test.
Attackers do not guess randomly. They try leaked password lists first, then dictionary words with the usual decorations (capital first letter, numbers or a year at the end, ! at the end), then everything else. This tool mirrors that: a password on the common-password list is rated as near-instant regardless of length, a decorated dictionary word is rated far weaker than raw character maths suggests, and only genuinely random or long passphrase-style passwords earn the big numbers.
The honest lesson is that length beats cleverness: four unrelated words beat every Pa$$w0rd! variant ever invented, and a password manager beats remembering either. Unique passwords per site plus multi-factor authentication is the combination that actually ends the problem.
The check runs entirely in your browser and the page sends nothing anywhere; you can verify by loading the page, disconnecting from the internet, and testing. That said, the safest habit is testing a password of the same style rather than the exact one, which tells you just as much.
Length and randomness, in that order. A 20-character passphrase of four unrelated words is stronger than an 8-character symbol soup, easier to type, and possible to remember. Strongest of all is not knowing your passwords: let a password manager generate and store them.
Because attackers learned the substitutions decades ago. Cracking tools try P@ssw0rd-style variants automatically, so an @ for an a adds almost nothing. The maths only works in your favour when the base material is unpredictable.
MFA is the single best protection and makes a stolen password far less useful, which is why insurers and the Essential Eight lead with it. But passwords still matter: MFA is not on everything, and reused passwords leak from other sites constantly. Unique passwords plus MFA is the pair.
It depends where. Against a website that throttles attempts: tens of guesses a second at best. Against a stolen database of weakly hashed passwords, modern GPU rigs try tens of billions of guesses per second. That gap is why the same password can be fine online and gone in seconds after a breach.
Belivanis Information Systems