Password Checker
AvailableCheck how strong a password is: common-password and pattern detection, estimated cracking time and tips — analyzed in your browser, never sent anywhere.
Checked in your browser. Your password is never sent to NetTools or stored. The optional breach check sends only a 5-character fragment of its hash.
Check a password
Start typing to check a password
Feedback
No common patterns found. Use a different password for every site, ideally stored in a password manager.
Estimated time to crack
| Attack scenario | Speed | Time |
|---|
Estimates assume the attacker knows common passwords and patterns — which real attackers do.
What the password is made of
- Length
- 0
- Character types
- LowercaseUppercaseDigitsSpecialBrackets
Patterns found
Pattern text is hidden while the password is masked.
Known data breaches
Check whether this password appears in Have I Been Pwned’s collection of passwords from real breaches. Only the first 5 characters of the password’s SHA-1 hash are sent; the comparison happens on your device.
Breach data: Have I Been Pwned, licensed CC BY 4.0.
Need a strong password? Use the Password Generator →
How it works
Your password is analyzed in the browser with zxcvbn, which looks for what attackers try first: common passwords from breach lists, dictionary words, names, keyboard patterns, sequences, repeats, dates and l33t substitutions. It estimates how many guesses are needed and how long that takes in different attack scenarios. The optional breach check uses the Have I Been Pwned k-anonymity API: only the first 5 characters of the password’s SHA-1 hash are sent, and matching happens on your device.
Safeguards & responsible use
- The password is analyzed locally and is never sent to NetTools or stored.
- The breach check is opt-in and sends only a 5-character hash prefix (k-anonymity) to Have I Been Pwned — never the password or its full hash.
- The input is masked by default and excluded from browser autofill and spell-check.
Frequently asked questions
Is it safe to type my real password here?
The analysis runs in your browser and nothing is sent unless you choose the breach check, which sends only a short hash prefix. Still, the safest habit is to check a password that is similar in style rather than your exact one.
Why is “P@ssw0rd!” rated weak?
Attackers try common words with predictable substitutions (a→@, o→0) and a symbol at the end first. Complexity rules don’t help when the pattern is predictable; length and randomness do.
What does the breach check do?
It tells you whether the password appears in Have I Been Pwned’s collection of passwords exposed in real data breaches. A found password should never be used, however strong it looks.
How are the cracking times calculated?
From the estimated number of guesses divided by typical attack speeds: from 100 guesses per hour (a rate-limited login) to 10 billion per second (a stolen database with a fast hash).