Password policies that demand "one uppercase, one digit, one symbol" produce Summer2024! and P@ssw0rd!, which satisfy the rules and fall in seconds to an attacker who knows how people satisfy rules. What actually matters is how many guesses an attacker needs, and whether the password is already in a breach list.
The Password Checker estimates that the way attackers do: it looks for common passwords, dictionary words, names, keyboard patterns, sequences, repeats, dates and l33t substitutions, shows estimated cracking times for four attack scenarios, and can optionally check the password against Have I Been Pwned without sending it anywhere.
What is a password strength checker?
In simple terms
A strength checker estimates how hard a password is to guess. Naive meters count character types and length. Better ones ask: if I were an attacker trying the most likely passwords first, how long until I hit this one? Common words, names, dates and keyboard runs come early in that list, so passwords built from them score low no matter how many symbols they contain.
Technical background
The checker uses zxcvbn (the TypeScript implementation zxcvbn-ts), a pattern-matching estimator originally published by Dropbox. It splits the password into the most likely sequence of matches:
- Dictionary words and common passwords from breach-derived frequency lists, English words and names, including reversed words and l33t substitutions (
@→a,0→o,3→e). - Spatial keyboard patterns such as
qwertyorzxcvbn. - Repeats (
aaaa,abcabc) and sequences (1234,abcd). - Dates and recent years.
- Bruteforce for segments that match nothing, estimated from length and character classes.
Each match has a guess estimate; the minimum total across possible decompositions is the password's estimated guesses, reported as log10. A score from 0 to 4 is derived from that count. Dividing guesses by an attacker's rate gives a time: online attacks are limited by the login service, while offline attacks against a stolen database depend on the password hashing algorithm. Slow, salted hashes (bcrypt, scrypt, Argon2) reduce the rate by many orders of magnitude compared with fast unsalted hashes.
Breach screening follows the k-anonymity model of Have I Been Pwned's Pwned Passwords range API: the client sends a 5-character prefix of the SHA-1 hash and receives every suffix with that prefix, so the service cannot tell which password was checked. Guidance such as NIST SP 800-63B recommends checking new passwords against known compromised values.
Why use the Password Checker?
- Test a password policy's real effect by checking passwords that typical users would choose under it.
- Explain to users why
CompanyName2024!is weak, with concrete patterns and cracking times. - Check whether a password has appeared in breaches before using it.
- Compare approaches, such as random characters versus passphrases, on the same scale.
Who should use it?
- Security and IT teams designing password policies and awareness training.
- System administrators reviewing service and device passwords.
- Developers choosing strength rules for sign-up forms.
- Anyone wondering whether their password style is good enough.
How the Password Checker works
Everything runs in your browser.
- As you type (after a 120 ms pause), the page analyzes the password with zxcvbn-ts. The dictionaries (common passwords, adjacency graphs for keyboard layouts, English words) are loaded lazily and warmed up when the browser is idle, so the first check may briefly show "Loading password dictionaries…". The checker also treats "nettools" and its variants as weak site-specific words and uses Levenshtein distance to catch near-matches of dictionary words.
- The result is a score (Very weak, Weak, Fair, Strong, Very strong), the estimated guesses as 10^N, feedback (a warning and suggestions), cracking times for four scenarios, length, character types present, and the patterns found.
- The Check breaches button is opt-in. It computes SHA-1 of the password with the Web Crypto API, sends only the first five hex characters to
api.pwnedpasswords.com/range/from your browser with theAdd-Paddingheader, no cookies and no referrer, and compares the returned suffixes locally. It times out after 10 seconds.
The input is a password field: masked by default, excluded from autofill and spell-check, limited to 256 characters, and cleared when you navigate away. Pattern tokens are hidden while the password is masked.
How to use the NetTools.tech Password Checker
- Open the Password Checker.
- Type or paste a password into Password to check. Use the eye button to show or hide it.
- Read the strength label and the guess estimate under the meter.
- Review Feedback, Estimated time to crack and What the password is made of (length, character types, patterns found).
- Optionally press Check breaches to query Have I Been Pwned. Press Check again after changing the password.
- If the result is weak or breached, generate a replacement with the Password Generator.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Strength label | zxcvbn score 0–4 as Very weak, Weak, Fair, Strong, Very strong | Aim for Strong or Very strong |
| ≈ 10^N guesses needed | Estimated attempts for a pattern-aware attacker | Each +1 in N is ten times more work |
| Feedback warning | The main weakness, e.g. "This is similar to a commonly used password." | Address the warning first |
| Suggestions | Specific improvements | Adding length beats adding one symbol |
| Online attack, rate-limited | 100 guesses per hour | Relevant for logins with lockout |
| Online attack, no rate limit | 10 guesses per second | Relevant for poorly protected services |
| Stolen database, slow hash | 10,000 guesses per second (bcrypt, Argon2) | What a breach of a well-built site means |
| Stolen database, fast hash | 10 billion guesses per second (MD5, SHA-1) | Worst case; times under an hour are highlighted |
| Length and character types | Characters counted and types present | Types alone do not mean strength |
| Patterns found | Segments such as common word, keyboard pattern, date, random characters | Masked unless you reveal the password |
| Breach result | "Found N times in data breaches" or "Not found in known breaches" | Any match means do not use it |
Example: why complexity is not strength
Checking P@ssw0rd! gives:
Very weak · ≈ 10^2 guesses needed
Warning: This is similar to a commonly used password.
Suggestions: Add more words that are less common.
Capitalize more than the first letter.
Avoid predictable letter substitutions like '@' for 'a'.
Online attack, rate-limited 100 guesses / hour 20 minutes
Online attack, no rate limit 10 guesses / second 3 seconds
Stolen database, slow hash 10,000 guesses / second less than a second
Stolen database, fast hash 10 billion guesses / sec less than a second
Patterns found: Common word or password (with l33t substitutions)Summer2024! scores Fair with about 10^7 guesses, falling in under a second against a fast hash. Length and randomness, not symbol rules, move the estimate: run a password from the generator through the checker to compare.
Common use cases
- Demonstrating weak password patterns in security awareness sessions.
- Evaluating whether a proposed password policy produces strong passwords in practice.
- Checking a password before reusing a style for a new account.
- Screening a password against breach data before setting it.
Troubleshooting
"The checker could not load"
The dictionaries failed to download, often because of a content blocker or a lost connection. Reload the page.
"The breach service could not be reached" or "did not answer in time"
Have I Been Pwned was unreachable from your browser within 10 seconds, or a blocker prevented the request. Your password was not sent; try again later.
The patterns list shows dots
Pattern text is hidden while the password is masked. Press the eye button to show it.
A strong-looking password is rated weak
It probably contains a common word, name, date or keyboard pattern, or is a near-match of a common password. Read the patterns found and the warning.
Common mistakes
- Treating a "Very strong" rating as permission to reuse the password on several sites.
- Ignoring a breach match because the strength score is high.
- Adding a symbol to a common word and expecting a big improvement.
- Using famous phrases or lyrics as passphrases; the dictionaries cannot know them all, attackers' lists can.
- Typing production credentials into any web form out of habit; prefer testing a similar password.
Limitations
- Estimates model a pattern-aware attacker using generic dictionaries; targeted attackers may use personal information (names of family, pets, employers) the checker does not know.
- Dictionaries are English plus common passwords; words from other languages may be underrated as weak.
- Cracking times use fixed reference rates; real rates depend on hardware and the hashing algorithm actually used.
- The breach check covers only what Have I Been Pwned has collected; "not found" is not a guarantee.
- The checker cannot tell whether you reuse a password elsewhere, which is often the bigger risk.
Security & privacy
The password is analyzed locally and never sent to NetTools or stored. Only if you press Check breaches does your browser (not the NetTools server) contact api.pwnedpasswords.com, sending the first five characters of the SHA-1 hash, never the password or the full hash, as also described in the privacy policy. The field is masked, excluded from autofill and spell-check, and cleared when you leave the page. As with any page, malware or a malicious extension on your device could read what you type; on shared or untrusted computers, do not enter real passwords.
Related tools
- Password Generator – create a random replacement. Guide: Password Generator guide.
- Web Pentest & Security Assessment – check your site's login pages and exposure. Guide: Website security assessment guide.
- SSL Checker – make sure passwords travel over valid TLS. Guide: SSL Certificate Checker guide.
- Overview: Security & Testing tools.
Summary
The Password Checker estimates strength with zxcvbn-ts pattern matching, shows guesses and cracking times for rate-limited, unthrottled, slow-hash and fast-hash attacks, and offers an opt-in Have I Been Pwned check that sends only a 5-character hash prefix. It shows why predictable "complex" passwords fail, and a breached password should be replaced whatever its score.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs in your browser and the password is never sent to NetTools or stored. The optional breach check sends only the first five characters of the password's SHA-1 hash. Still, the safest habit is to test a password of the same style rather than your exact current one.
Why is P@ssw0rd! rated very weak even though it has all character types?
Attackers try common words with predictable substitutions such as @ for a and 0 for o, plus a symbol at the end, very early. The checker recognizes it as a variant of a common password and shows an estimate of only about 10^2 guesses, so complexity rules alone give a false sense of security.
How are the cracking times calculated?
The estimated number of guesses is divided by four typical attack rates: 100 guesses per hour for a rate-limited login, 10 per second without rate limiting, 10,000 per second against a slow hash such as bcrypt or Argon2, and 10 billion per second against a fast hash such as MD5 or SHA-1.
What does the breach check do?
It asks Have I Been Pwned's Pwned Passwords service whether the password appears in its collection of passwords exposed in real breaches. A password that is found should never be used, no matter how strong it looks.
How does the breach check work without sending my password?
Your browser computes the SHA-1 hash of the password and sends only its first five hex characters. The service returns all hash suffixes starting with that prefix, padded with dummy entries, and your browser checks locally whether the full hash is among them.
What does the guesses number mean?
It is the checker's estimate of how many attempts an attacker using common passwords, dictionaries and patterns would need, shown as a power of ten. Each step of ten means ten times more work for the attacker.
Why does my long passphrase score well?
Length adds guesses quickly when the words are not a known phrase. The checker evaluates words against its dictionaries but cannot know every famous quote or lyric, so avoid well-known phrases even when they score highly.