Password strength analysis

Please notice: This tool sends your password to our server for analysis and comparison to large wordlists. We keep no logs, but this is not a trustless system. Do not use real passwords if you do not trust us with them!

Q&A

What does this tool do?

This tool will analyze your password's strength and explain the patterns, habits, and weaknesses that may make it easier to crack. Instead of giving only a simple score, it breaks the password down into different categories and explains how attackers and password cracking tools may approach it. The goal is not just to say whether a password is weak or strong, but to also explain why that's the case.

The checker looks at things such as password length, character variety, common patterns, dictionary words, years, and predictable structures. For example, many passwords appear complex at first glance but still follow patterns commonly used by real people, such as adding numbers to the end of a word or replacing letters with simple symbols. Password cracking tools and wordlists are designed around these habits because humans tend to be much more predictable than they think.

The tool also checks for common masks and structures often targeted by cracking software. Passwords like words followed by numbers, birthdays, or repeated characters are extremely common and are usually tested early during attacks. Even passwords containing mixed character types can still be vulnerable if they follow familiar human patterns. The analysis attempts to explain these risks clearly and practically instead of hiding everything behind an arbitrary rating number.

Is adding a year to a password safe?

Adding a year (like 1999 or 2023) to a password is not considered safe because it is highly predictable. Attackers often test common year patterns first, which makes passwords containing them much easier to crack.

How long does it take to crack an 8-character password?

An 8-character password can be cracked very quickly if it uses common words or predictable patterns. Even with mixed characters, shorter passwords are significantly more vulnerable to modern brute-force attacks.

Are passwords with only lowercase letters secure?

They can be. For randomly generated passwords of the same length, a larger character set provides more possible combinations. But adding a predictable capital letter or symbol to a human-chosen password does not make it reliably strong.

Is a long password without symbols still strong?

Yes. A sufficiently long random password or a passphrase made from independently random word choices can be strong without symbols. A familiar quotation or sentence is more predictable.

Why are dictionary words dangerous in passwords?

A single word or a predictable variation is easy to target. This checker also flags word fragments after lowercasing and reversing some common letter substitutions. A match is a clue, not proof that the whole password is weak: the checker cannot tell how the words were chosen.

What makes a password easy to guess?

Passwords built from predictable choices, such as a single common word, repeated characters, or personal information like names and dates, are easier to target. Random word selection is different from choosing a familiar phrase.

Is using a name in a password a bad idea?

Using names in passwords is risky because names are commonly included in cracking wordlists. Even if combined with numbers, they can often be guessed quickly.

How important is password length compared to complexity?

Length helps, but predictability still matters. Repeating a word or appending a familiar sequence adds characters without the benefit of random choices. NIST’s current password guidance does not require mixtures of character types and checks blocklists against whole passwords, not their component words.

Are patterns like “word123” secure?

Patterns like “word123” are very common and are specifically targeted by attackers. Even if the password looks complex, predictable patterns make it much easier to crack.

What is the safest type of password to use?

Use a long, randomly generated password that is unique to each account, stored in a password manager. Randomly generated passphrases are another option. The checker’s individual warnings are pattern hints, not a guarantee of safety or a measurement of how randomly a password was generated.