How strong is your password?
Type a password and see how long it would take to crack, and why. It never leaves this page.
Start typing to see how long your password would resist an attack.
- 1. Type a password
- 2. It is scored on your device
- 3. See the time to crack and how to fix it
This password strength checker estimates how many guesses it would take to crack a password or passphrase, and explains what makes it weak. It runs entirely in your browser: what you type is analyzed on your device and is never sent, logged, or stored.
What the checker does
Length alone does not make a password strong. "Password2026!" has upper and lower case, digits, and a symbol, and it is still one of the first things an attacker tries. Real attackers do not guess randomly; they start with leaked password lists, dictionary words, names, dates, keyboard walks like "qwerty," and common substitutions like "@" for "a."
The checker models that behavior. It breaks your input into recognizable pieces, estimates how many guesses each piece would take, and combines them into a score and a time-to-crack estimate.
How to use it
- Type a password or passphrase into the field above.
- Watch the score and feedback update as you type.
- Adjust and compare. Try adding a random word rather than a symbol.
How to read the results
- Score. A simple scale from very weak to very strong, based on the estimated number of guesses.
- Time to crack. Estimates for different attack scenarios. An online attack against a service with rate limiting is very slow; an offline attack against a stolen file of hashed passwords can be extremely fast. A password that holds up only against the first is not strong.
- Warnings and suggestions. Specific reasons the score is low — "this is a common password," "dates are easy to guess," "repeated characters" — with ideas to improve it.
What it cannot tell you: whether your password has already appeared in a data breach, or whether you have reused it elsewhere. Reuse is the bigger risk for most people.
Passphrases versus complex passwords
There are two common ways to get a strong secret:
- A random password of mixed characters, ideally generated by a password manager. Excellent strength, impossible to remember, so it belongs in a manager rather than your head.
- A random passphrase of several unrelated words. Easier to type and remember, and strong when the words are truly chosen at random — not a song lyric, a quote, or a sentence about your life.
Run a few examples through the checker and the difference becomes obvious: a famous quote scores poorly despite its length, while four or five random everyday words usually score well. The same principle is behind the word lists used for recovery phrases.
Where your strongest secrets should go
You do not need every password to be memorable. Most can be random and stored in a password manager. The few you must type from memory — your phone passcode, your Apple Account password, your password manager's main password — deserve the most attention, because protecting everything else depends on them.
How to do this on iPhone, natively
iPhone has strong built-in tools for this:
- Passwords app. On recent iOS versions, the Passwords app has a Security section that flags weak, reused, and compromised passwords saved in your iCloud Keychain.
- Strong password suggestions. When you create an account in Safari or a supported app, iOS can generate and save a strong random password for you.
- Your device passcode. Settings > Face ID & Passcode > Change Passcode > Passcode Options lets you choose a custom alphanumeric code — the strongest option for unlocking the phone itself, and the one that matters most if your phone is lost or stolen.
For a comparison of the options, see pattern lock vs PIN vs password. If you use a sign rather than a password, try the pattern strength meter.
Strong secrets in sigil.
sigil. does not use passwords. Your vault is encrypted with a 256-bit key that only a sign you draw on a 5×5 grid unlocks. That sign is not your phone passcode, so knowing one does not reveal the other. See pattern encryption.
As a backup, sigil. gives you a 12-word recovery phrase chosen at random from a 2,048-word list — about 128 bits of randomness, far beyond anything a person would invent. Write it down offline; we cannot recover it for you. There is no account, so there is no password of ours to leak.
Frequently asked questions
Is it safe to type my password here?
The checker runs entirely in your browser and sends nothing over the network. Even so, the safest habit is to test a similar password rather than the exact one you use.
How does the checker estimate strength?
It looks for patterns attackers try first — common passwords, dictionary words, names, dates, keyboard sequences, repeats, and predictable substitutions — and estimates how many guesses would be needed.
What is a good passcode for an iPhone?
A custom alphanumeric passcode is strongest. If you prefer numbers, a longer custom numeric code beats a 6-digit one. Avoid birthdays and repeated digits.
Are passphrases better than complex passwords?
Often, yes. Several random words are easier to remember and can be harder to guess than a short password with symbols. The key word is random.
Does the checker know if my password was leaked?
No. It estimates guessability; it does not check breach databases. On iPhone, the Passwords app can warn about passwords that appeared in known leaks.