Browse tools

Password Strength Tester

Type a password to see how long it would really take to crack: by guessing on a website, from a stolen database with today's graphics cards, and with tomorrow's GPUs, AI data centres and quantum computers. We show the patterns that give it away and check it against known data breaches.

Start typing

How long to crack it

Average time to find it, for each kind of attack.

Type a password above.

What gives it away

    GPUs, AI chips and quantum computers

    • Today's GPUs are the main threat. One top gaming card tries around 250 billion passwords a second against weakly stored ones (MD5, unsalted SHA-1, Windows NTLM), and a cracking rig has eight. Properly stored passwords (bcrypt, scrypt, Argon2) cut that to thousands a second.
    • Future GPUs and AI chips keep getting faster. A data centre of 100,000 AI accelerators, if turned to cracking, could try tens of quadrillions of weak hashes a second, so anything under about 12 random characters stored weakly won't last.
    • AI-guided guessing doesn't make hardware faster; it guesses in a smarter order. Models trained on leaked passwords try the human patterns first: names, words, years, "!" on the end, letters swapped for symbols. Truly random passwords give it nothing to learn from.
    • Quantum computers running Grover's algorithm could search in roughly the square root of the normal number of steps, which halves a password's strength in bits. But each step is slow, the machines needed don't exist yet, and the speed-up doesn't scale well across many machines. A 16-character random password or a 7-word passphrase stays out of reach.
    • The real quantum risk is to encryption (RSA and elliptic curves), not passwords, which is why websites and messaging apps are moving to post-quantum encryption.

    What makes a strong password

    • Length beats complexity. Six or more random words, or 16 or more random characters, beat a short password full of symbols.
    • Random, not clever. Patterns you think are clever (P@ssw0rd!, Summer2026, your pet plus a year) are the first thing cracking tools try.
    • Never reuse one. When one site is breached, attackers try the same email and password everywhere. A password manager makes unique passwords easy.
    • Turn on two-step verification (MFA), ideally with an authenticator app or passkey, so a stolen password alone isn't enough.
    • Need one? Use our Password Generator.

    How the breach check stays private

    Your browser turns the password into a SHA-1 fingerprint and sends only its first 5 characters to our server, which asks Have I Been Pwned for every fingerprint starting with those 5 characters (hundreds of them, plus random padding). Your browser then looks for a match itself. Neither we nor Have I Been Pwned ever see your password or its full fingerprint. Everything else on this page happens only in your browser.

    More free tools