See how long your password would survive a real attack, from patient online guessing to an offline GPU rig. Analysis runs on your device with zero network requests and zero storage.
There is something absurd about most password checkers: they ask you to send your password to a stranger's server to find out if it is safe. This one takes the only approach that makes sense. The analysis engine (zxcvbn, built at Dropbox and used across the industry) loads into your browser, and everything after that happens on your device. No network request fires when you type, nothing is saved anywhere, and the page keeps working with your Wi-Fi turned off.
Cracking software does not guess randomly. It tries dictionary words, names, dates, keyboard walks, and the classic substitutions first, which is why P@ssw0rd1! falls in seconds while a boring-looking four-word passphrase holds for centuries. This auditor thinks like that software: it finds the patterns inside your password, counts how many guesses a smart attacker actually needs, and shows you which parts would be guessed early.
Length, randomness, and uniqueness. Every added character multiplies the guesses needed, which is why a long random passphrase beats a short symbol jumble. Uniqueness matters because attackers replay leaked passwords everywhere else you used them. The practical recipe: a password manager generating long random passwords, one per site, with a strong passphrase guarding the manager itself.
Being suspicious of a page that asks for a password is the right instinct, and we would rather sharpen it than argue with it. So: verify this page with DevTools open, or load it, disconnect from the internet, and use it offline. And if you prefer to never type a real password anywhere outside its login, test one with the same structure instead; the verdict will be the same.
Only if the checking happens on your own device, which is exactly how this one works. The analysis runs in your browser, nothing you type is sent anywhere or saved anywhere (not even locally), and the page keeps working with your internet disconnected. If you want to be extra careful, test a password with the same structure as yours rather than the exact one.
The auditor uses zxcvbn, the estimator built at Dropbox and used across the industry. It counts how many guesses a smart attacker would need (trying dictionary words, names, dates, keyboard patterns, and substitutions first) and translates that into time across four scenarios, from throttled online guessing to an offline attack on fast hardware.
Because attackers know the tricks. P@ssw0rd1! follows the exact pattern cracking software tries first: a common word, obvious substitutions, a digit, a symbol at the end. The auditor detects these patterns and shows you which parts of your password an attacker would guess early.
Length beats cleverness. A four-word random passphrase outperforms a short jumble of symbols because every added character multiplies the guesses needed. Random, long, and unique per site is the whole game; a password manager makes all three easy.
No. There is no network request when you type, no server-side check, no localStorage, no history. Close the tab and the password existed only in your device's memory. You can verify with your browser's DevTools network tab while typing.