Password Strength CheckerScore, Crack Time and Tips

A strength meter that says "Strong" is giving you a hint, not a promise. The Kwebby Password Strength Checker estimates how many guesses an attacker would need for a password, flags the patterns that make it easy to guess and shows crack times for four kinds of attack. Use it to learn what makes a password weak, not as proof that one is safe.

One rule comes first. Never type a password you use today into any online checker, ours included. Test a sample with the same length and pattern instead.

Key Takeaways

• Kwebby's Password Strength Checker estimates the number of guesses a password needs, shows it as bits of entropy and rates it Very Weak, Weak, Fair, Strong or Very Strong (score 0 to 4).
• It looks for common passwords, dictionary words and names, leetspeak swaps such as @ for a, years, dates, keyboard walks, sequences such as 123 or abc, and repeats. Summer2024!! rates only Fair because it is a common word, a year and two symbols.
• Crack times are shown for four attacks: a rate-limited online attack, an online attack with no limit, an offline attack on a slow hash such as bcrypt and an offline attack on a fast hash such as MD5.
• The word lists are small and built into the page, so the estimate is a rough guide. The checker has no breach database.
• Length and unpredictability beat forced symbol mixes. NIST SP 800-63B-4 says services must require at least 15 characters when a password is the only factor.
• When a password rates poorly, replace it with a random one from the Password Generator and store it in a password manager.

What Is the Kwebby Password Strength Checker?

Kwebby's Password Strength Checker is a free online tool that estimates how hard a password is to guess. It splits the password into the most guessable pieces it can find, such as a common word, a year or a keyboard walk, and counts the guesses each piece needs. It treats anything it cannot match as random characters. The total gives a score from 0 to 4, a level from Very Weak to Very Strong, an entropy figure in bits and crack times for four attack types.

The check runs in your browser as you type, and the page's script sends the password nowhere. No account is needed.

Key Features and How It Works

Pattern matching, not a checklist

Old meters count character types, so "Summer2024!!" looks perfect: it has capitals, lowercase, digits and symbols. Attackers do not guess that way. They try common passwords, words, names, years and keyboard walks first. This checker looks for the same things:

• Common passwords such as password, qwerty, iloveyou and letmein, from a built-in list of well-known leaked passwords.
• Dictionary words and names such as summer, tiger, london or michael, from a built-in list of a few hundred common words.
• Leetspeak: it reads @ as a, 0 as o, 3 as e, $ as s and similar swaps, so P@ssw0rd still counts as "password".
• Capitals: a capital first letter or an all-caps word adds very little.
• Years and dates such as 1990, 2024 or 01011990.
• Keyboard patterns such as qwerty, asdfgh, 1q2w3e4r and number pad runs.
• Sequences such as abc, 123 or 987.
• Repeats such as aaa or abcabc.

The result panel shows how the checker split your password, with a label for each piece. When Show is off, the pieces appear as dots.

Guesses, bits and five levels

The checker multiplies the guesses for each piece and adds a penalty for the number of pieces. The total appears as a power of ten and as bits of entropy. The level follows the guess count: under 1,000 guesses is Very Weak, under 1 million is Weak, under 100 million is Fair, under 10 billion is Strong, and 10 billion or more is Very Strong. A password shorter than 8 characters never rates above Weak.

Crack times for four attacks

How fast an attacker can guess depends on where the password is stored. The checker shows four estimates, each assuming half the guesses are needed on average:

• Online attack, rate limited: 100 guesses per hour.
• Online attack, no rate limit: 10 guesses per second.
• Offline attack on a slow hash such as bcrypt: 10,000 guesses per second.
• Offline attack on a fast hash such as MD5: 10 billion guesses per second.

These are fixed assumptions, not measurements. The approach follows the open source zxcvbn estimator, with much smaller word lists.

Warnings and suggestions

Below the crack times you see a warning for each pattern found, such as "Contains a year" or "Contains a keyboard pattern", and a short list of suggestions, such as using at least 15 characters or a passphrase of unrelated words.

Show and Hide toggle

The password field hides what you type. The Show button reveals it so you can catch typos, and it switches to Hide. Use it only when no one can see your screen.

Checks run in your browser

The tool keeps the password in the page and runs the checks locally. The page's script makes no network request with it. Even so, the safe habit is to test a lookalike sample.

Why Password Strength Matters

Weak and predictable passwords are the first ones an attacker tries. NIST SP 800-63B-4 reflects this: services must compare new passwords against a blocklist of commonly used or compromised ones, must require at least 15 characters when a password is the only factor, and must not force composition rules such as "one capital and one symbol".

That is why this checker does not reward character types on their own. A long phrase of four unrelated lowercase words rates higher than Summer2024!!, because the phrase needs far more guesses. Neither result tells you whether the password has leaked or been reused. The checker has no breach database, so a good score does not mean a password has never been exposed.

How to Use the Password Strength Checker

1. Pick a safe test password. Do not type a password you use today. Make a sample with the same length and style, for example swap the real words for other words of the same kind.
2. Type it into the field. The box reads "Enter a sample password…". Until you type, the results area reads "Start typing to see the strength analysis…". The results update as you type.
3. Click Show if you need it. Use the Show button to check for typos and to see the matched pieces, then click Hide. Do it only when nobody can see your screen.
4. Read the level and crack times. The colored label gives the level, the bar fills to match, and the guess count and bits sit beside it. The four boxes below show the crack times.
5. Read the warnings. Each warning names a pattern that makes the password easier to guess. Replace those parts.
6. Create a real replacement. Open the Password Generator, make a long random password and save it in a password manager.

Best Practices for Checking Password Strength

Treat the score as a hint

A meter estimates guessability from patterns it knows. It cannot know where else you use the password, who has seen it or whether it appeared in a breach. Use a good score as a minimum bar, not a stamp of approval.

Never test a live password

Common mistake: pasting your real email password to see the result. Even when a tool runs in your browser, as this one does, the safest habit is the same everywhere. Test a lookalike sample.

Judge length first

NIST SP 800-63B-4 asks services to require at least 15 characters for passwords used alone and to accept at least 64. The checker suggests 15 or more characters whenever a password is shorter. Long beats clever.

Avoid predictable patterns

Keyboard walks, years, seasons, names and simple substitutions such as "@" for "a" are in every attacker's wordlist. This checker knows a few hundred of them; real attack lists hold millions. A word it does not flag can still be in an attacker's list, so a random string or a few unrelated words is the safer choice.

Pair strong passwords with unique use and a second factor

Use one password per account, keep them in a password manager and turn on two-factor authentication. Strength alone does not protect a reused password.

Common Use Cases

• Personal password review. Test sample passwords that resemble your old habits to see which patterns give them away.
• Team training. Show colleagues how a name plus a year compares with a random string or a passphrase.
• Sign-up form design. Developers see how a pattern-aware meter reads sample passwords before building one. Test accounts can use profiles from the Fake Address Generator.
• Checking a generated password. Confirm that a password from the generator rates Very Strong.

Related Kwebby Tools

The Calculators & Utilities hub holds the tools that pair with this one:

• Password Generator creates random passwords from 4 to 128 characters, which is the quickest fix for a weak result.
• MD5 & Hash Generator creates hashes from text. MD5 is not suitable for storing passwords, so use it for checksums, not for security.
• Fake Address Generator creates fictional profiles for test accounts.

Final Thoughts

A strength checker helps you spot weak habits fast. It does not prove a password is safe, and it should never see a password you use today.

Try a few sample passwords now and read the warnings. Then open the Password Generator to create a long random replacement, save it in a password manager and turn on two-factor authentication. The full Kwebby tools list has more utilities for your workflow.