Type a password. The checker splits the string into the words, dates, and keyboard runs attackers try first, then counts the guesses left over. Scoring runs inside this browser tab.
No network request happens while you type. The only thing sent anywhere is a 5-character hash prefix, and only after you press the breach check button.
Verdict
| Attack | Time |
|---|---|
| Login form with lockout100 guesses per hour | – |
| Login form, no lockout10 guesses per second | – |
| Leaked bcrypt hash5,700 per second, one RTX 4090 | – |
| Leaked MD5 hash164 billion per second, one RTX 4090 | – |
Your browser hashes the password with SHA-1 and sends the first 5 of 40 hex characters to Have I Been Pwned. The service returns every leaked hash sharing those 5 characters, about 800 of them, and the match happens here.
Summer2024! ticks every box on a typical sign-up form: 11 characters, a capital, digits, a symbol. Counted as 11 random characters from a 95-character keyboard, the string has 72 bits of entropy and 5.7 × 1021 combinations. Nobody guesses passwords at random, though. Cracking tools start from word lists and bolt on years and symbols, so the checker prices each piece the way those tools would.
| Piece | Read as | Guesses |
|---|---|---|
Summer | A top entry on the word list, first letter capitalized | 2 |
2024 | A year within 20 of today, priced as one of 20 | 20 |
! | One of 33 printable symbols | 33 |
| Pattern charge | ×2 for each pattern the attacker has to pick | ×4 |
| Total | 5,280 | |
5,280 guesses is 12 bits. A login form with no lockout, taking 10 guesses a second, gives the account up in about 9 minutes. Press the Summer2024! sample above and the results panel shows the same split.
Crack time means nothing without a guessing rate. The results table uses four, from slowest to fastest.
| Attack | Rate | Where the number comes from |
|---|---|---|
| Login form with lockout | 100 / hour | NIST SP 800-63B caps failed attempts at 100 per account before a lockout or delay kicks in. |
| Login form, no lockout | 10 / second | Guesses sent over the network to a site with no rate limit. Network round trips set the ceiling. |
| Leaked bcrypt hash | 5,700 / second | Hashcat benchmarks put one RTX 4090 at 184,000 bcrypt hashes per second at cost 5. Each cost step doubles the work, so cost 10 lands near 5,700. |
| Leaked MD5 hash | 164 billion / second | Same card, same benchmark. NTLM, the Windows password hash, runs faster still at about 288 billion. |
Every offline figure assumes one GPU. A rented rig with eight cards divides the time by eight. The online rows assume the attacker has nothing better than guessing, so a password reused on a breached site skips the table entirely. Credential stuffing tries the leaked password as-is, no cracking needed.
The checker looks for seven kinds of shortcut, then picks the cheapest path through your password: some pieces matched as patterns, the rest priced as random characters. The colors match the blocks in the results.
password sits at #2 and shows up 52 million times in breach data.@ for a and 0 for o.asdf, !@#$, poiu.123, xyz, 9876. Runs starting at 1, 0, or a cost the least.aaaa or abcabc. The second copy adds almost nothing, since the attacker only has to guess the block once.15/04/1992 or 150492. Recent years cost the least.A strength score is an estimate of what an attacker knows. Here is what this one does not know.
Tr0ub4dor&3 rates Strong here at 48 bits. The xkcd comic behind the string put the figure near 28.NIST SP 800-63B, revision 4, finalized in 2025, sets the rules most security teams now follow. Five points matter when you pick a password or write a password policy:
Read together, the rules say length beats symbols and a leaked password is dead no matter how complex. A password manager generating 18 random characters per site meets every point without you memorizing any of them.
Privacy, entropy, symbols, and the breach lookup.
On this page the scoring runs in JavaScript inside your browser tab, with no request sent while you type. Open your browser network panel and watch. The breach check sends 5 characters of a SHA-1 hash, never the password. Still, a page you have no reason to trust deserves a test password, not your bank login.
Most sign-up meters count character types and length. This checker looks for the words, years, and keyboard runs inside the password and prices each one at the cost an attacker pays. Summer2024! passes most sign-up meters and lands at 12 bits here.
Bits are the base-2 logarithm of the number of guesses. 40 bits means about 1.1 trillion guesses, and each extra bit doubles the count. The checker shows two figures: the bits from character-set math, and the bits left after patterns are removed. The second figure decides crack time.
The check uses the k-anonymity range API from Have I Been Pwned. Your browser computes the SHA-1 hash, sends the first 5 hex characters, and receives every leaked hash starting with those characters. The comparison happens on your device, and padding hides how many real matches came back.
One symbol at the end adds about 5 bits, since attackers try all 33 printable symbols in the final position. One extra random lowercase letter adds 4.7 bits and is easier to type. Four extra random characters of any kind beat any amount of symbol decoration on a dictionary word.
NIST now asks for 15 characters when a password is the only login factor. For an account behind a password manager, 18 or more random characters reach the Excellent band on this checker. For a password you type from memory, four or five words picked at random clear 15 characters with room to spare.