Free Password Strength Checker
Type a password to see how long it would hold up against an attacker with a leaked copy, and exactly what would make it stronger. The check runs on your device, so the password never leaves this page.
The result shows here as you type: a strength rating, how long a fast offline attack would take, and what would make it stronger.
Stays in This Browser Tab
The check runs on your device as you type. The password is never sent or saved, and it's gone when you close the tab.
How the Estimate Works
It counts the characters you used, then discounts what guessers try first: common passwords, swapped look-alike letters, repeats and keyboard runs. Crack time assumes ten billion guesses a second against a leaked, fast-hashed copy.
Why a 6-Digit Passcode Is Different
HypaVault's passcode is stretched with Argon2id and tied to a key kept only in your phone's secure storage, so it can't be guessed offline. On the phone, the lock screen makes guessers wait after 5 wrong tries.
How Strong Is My Password?
A password's strength is how many guesses an attacker would need to find it. Length adds the most strength; mixing capitals, numbers and symbols helps less than people think. Common passwords, swapped look-alike letters like p@ssw0rd, repeats and keyboard runs are tried first, so they add almost nothing. This checker estimates the guesses needed and the time a fast offline attack would take, then tells you what to change.
How to Use It
- 1Type or paste a password into the box. Use the eye button to show or hide it.
- 2Read the rating, the estimated time to crack and the strength in bits.
- 3Follow the tips, then try the stronger version to compare.
Keep Going
Questions About the Password Strength Checker
See how long a password would survive a guessing attack, and how to make it stronger.
No. The checker runs in your browser as you type. The password isn't sent or saved, and it's gone when you close the tab.
It assumes an attacker with a leaked, fast-hashed copy trying ten billion guesses a second, and discounts what they try first: common passwords, look-alike swaps, repeats and keyboard runs. Treat it as a rough guide, not a promise.
Length, and unpredictability. CISA recommends at least 16 characters, or a passphrase of 4 to 7 unrelated words, and either beats a short password full of symbols. Avoid names, dates, common words and keyboard patterns.
Barely. Guessing tools try swaps like @ for a and 0 for o straight away, so p@ssw0rd is about as weak as password.
It's a measure of how many guesses a password would take. Each extra bit doubles the guesses, so 60 bits is a thousand times harder than 50.
No. If one site leaks it, every account that shares it is exposed. Use a different password for every account, and a password manager to remember them.
Because the passcode isn't the whole lock. It's stretched with Argon2id and tied to a device key kept in your phone's secure storage, so a copy of the vault's files isn't enough to start guessing. On the phone, the lock screen makes guessers wait after 5 wrong tries, up to an hour.
Read the Help ArticleYou can, but a phone passcode is protected differently: guesses happen on the device, which slows them down. This checker is built for passwords that could be attacked offline.
More Free Tools
A Vault Guessing Can't Open
HypaVault's passcode is stretched with Argon2id and tied to your phone, and wrong tries are slowed down. Free on iPhone, iPad and Android.