Skip to the tool
Log inGet Vivid360

Password strength checker

See how hard a password is to guess

Runs in your browser. Nothing is sent unless you share it.

Example

Checked in your browser. The breach check sends only the first 5 characters of the password's SHA-1 hash to Have I Been Pwned (k-anonymity), and the password never leaves this device.

Make a strong password

Made in your browser and never sent anywhere.

Strength

Very weak

Time to guess online (100 tries an hour)
3 years
Time to guess offline (fast attack)
instantly

The example is not checked against breaches. Type your own password to check it.

Tips

  • It is built on a common word or password. Use several unrelated words or a random password instead.
  • Adding a number, a year or ! to a word is predictable. Add more random characters instead.
  • Add more characters. Length matters more than complexity.
  • Years are easy to guess. Avoid birth years and the current year.
vivid360.io/tools/password-strength

How it works

  1. Type a password. It stays hidden unless you choose to show it.
  2. We look for what attackers try first: common passwords and words, letters swapped for numbers, keyboard runs, repeats and years.
  3. Read the rating from Very weak to Very strong, the time to crack it and tips to make it stronger.
  4. Or make a new password with the generator: choose its length, then check it here.

Related tools

WiFi QRLet guests join your WiFi by scanningLink shortenerMake long links short and easy to shareID number checkerCheck an ID number's format

Questions

What makes a password strong?

Length matters most. A long password made of several random words or random characters is far harder to guess than a short one with a symbol added at the end.

Why is Password1 rated weak?

It is a common word with a predictable ending. Attackers try lists of such passwords first, with the usual swaps such as @ for a and 0 for o.

What does the breach check do?

It checks whether the password appears in known data breaches, using the Have I Been Pwned service. Only the first five characters of a scrambled code of the password are sent, never the password itself.

What do the crack times mean?

One assumes an attacker guessing online at about 100 tries an hour. The other assumes a stolen password file attacked at 10 billion guesses a second.

Is my password sent to you?

No. The password is checked in your browser and never leaves it. The breach check sends only five characters of a scrambled code, which cannot be turned back into your password.