YUCTS Tools

Password Strength Checker (guessability and crack time)

Estimate how guessable a password is from its length, character types, common passwords, keyboard runs, sequences and dates, with crack-time ranges. Runs in your browser; nothing is sent or saved.

  • Runs in your browser (no upload)

The check runs only inside this browser. The password you type is never sent, saved or logged.

This is not a breach check. It does not look anything up in leaked-password databases such as Have I Been Pwned; it only estimates how guessable the password is, on your device.

The field starts with the sample "P@ssw0rd2024". Replace it with the password you want to check.

Pattern examples

Estimate

Strength: Very weak (0/4)

Estimated guesses
15,000
Entropy equivalent
about 14 bits
Length
12 characters
Character types used
lowercase, uppercase, digits, symbols or spaces

Estimated time to crack

Time needed to try the estimated number of guesses. The range reflects the assumed attack speeds; a real attacker may succeed sooner or later.

  • Online attack, rate-limitedLogin attempts limited to 10–100 per hour6 days – 2 months
  • Online attack, no rate limit10–100 guesses per second3 minutes – 25 minutes
  • Offline attack, slow hash1,000–100,000 guesses per second against leaked bcrypt, scrypt or Argon2 hashesinstantly (under 1 second) – 15 seconds
  • Offline attack, fast hash10 billion – 1 trillion guesses per second on GPUs against unsalted MD5, SHA-1 or similar hashesinstantly (under 1 second)

Warnings

  • This contains a common password.
  • Years are easy to guess.

Suggestions

  • Use 15 or more characters, or a passphrase made of several unrelated words.
  • Avoid common passwords and parts of them.
  • Predictable substitutions such as @ for a add very little strength.
  • Capitalising only the first letter, or every letter, adds very little strength.
  • Avoid dates and years connected to you, such as birthdays or anniversaries.
  • Use a different password for every service; a password manager can generate and store them for you.

Patterns found

The matching characters are shown only when "Show password" is on.

  1. Common passwordcharacters 1–8 · ••••••••rank 1 of 10,001, with substitutions, with capitalsabout 3 bits
  2. Yearcharacters 9–12 · ••••about 4 bits
Source and licence of the common-password list (SecLists, MIT License)

SecLists, Passwords/Common-Credentials/10k-most-common.txt https://github.com/danielmiessler/SecLists (commit 913b327317496d062bcc7cace524aaad8a693be2) MIT License Copyright (c) 2018 Daniel Miessler Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

How to use

  1. Type the password you want to check (the field starts with a sample; tick "Show password" to see the characters).
  2. Read the strength rating, the estimated number of guesses and the crack-time range for each type of attack.
  3. Use the warnings and suggestions to make the password longer and harder to guess.

FAQ

Is my password sent anywhere?

No. Everything is evaluated inside your browser. The password is never sent, saved or logged, and it is never put in the URL. "Copy result" copies the estimate without the password.

Does this tell me whether my password has been leaked?

No, this is not a breach check. It does not query Have I Been Pwned or any other leaked-password database. The only list it checks is a public list of about 10,000 common passwords (SecLists).

How are the guesses and crack times calculated?

The tool looks for common passwords (including capitals, symbol substitutions and reversal), repeats, sequences, keyboard runs, dates and years, and finds the combination that covers the whole password with the fewest guesses: the approach from the zxcvbn paper, implemented independently. Parts without a pattern are counted as brute force over their character types. The guesses are then divided by assumed speeds from 10–100 per hour (rate-limited online attack) up to 10 billion – 1 trillion per second (offline attack on a fast hash).

How are the ratings decided?

By the estimated guesses: at least 10^6 is "Weak" (over a year for a rate-limited online attack), 10^12 is "Fair" (months even for an offline attack on a slow hash), 10^17 is "Strong" (over a day even on a fast hash) and 10^20 is "Very strong" (over three years even on a fast hash).

How do I make a strong password?

Use 15 or more characters, or a passphrase of four or five unrelated words. Use a different password for every service, let a password manager generate and store them, and turn on two-step verification where you can.

Notes & limitations

  • What you enter is processed only on this page and is not sent to YUCTS servers.
  • This is only an estimate. Real attackers use other dictionaries and strategies, so the actual number of guesses and the time needed can differ a lot.
  • The only dictionary is a list of about 10,000 common passwords (SecLists). Ordinary words, names and phrases that are not on that list are not recognised, so word-based passwords can look stronger than they are.
  • Personal information such as your name, birthday or pet’s name cannot be taken into account.
  • Keyboard patterns assume a US QWERTY layout only.
  • This is not a breach check; no leaked-password database is queried.
  • The password never leaves your browser and is not stored or logged. Up to 256 characters are evaluated.

Data sources