Zxcvbn Password Strength

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from Zxcvbn Password Strength

Zxcvbn Password Strength analyzes a password you enter and estimates how difficult its recognizable patterns may be to guess. The page contains a password field, a strength meter, estimated cracking times, and feedback when the estimator has a relevant warning or suggestion. It does not generate passwords or offer length and character-set controls. This implementation uses zxcvbn with common and English dictionaries and keyboard-pattern information, so a long string containing familiar words or predictable substitutions can receive a lower estimate than its length suggests. Use disposable examples to explore those differences, and read the explanation alongside the meter instead of treating a large duration as a promise.

Guide updated October 13, 2026

How to use this tool

1. Enter a disposable sample in the password field. Use the visibility control only when it is appropriate to show the sample on screen.
2. Read the strength label and meter, then inspect any warning or suggestion beneath the result.
3. Compare the displayed attack scenarios. Their time estimates depend on assumed guessing rates; they are not observations of an attack against an account.
4. Change one feature of the sample, such as a repeated suffix or a familiar word sequence, and compare the feedback. Clear the field when the comparison is complete.

SEE IT IN PRACTICE

A worked example

password123

A low strength estimate with any applicable zxcvbn feedback.

This public demonstration combines a familiar word with a predictable numeric suffix. Exact wording and durations depend on the estimator version; the useful observation is that added characters do not automatically remove predictability.

What the zxcvbn meter measures

The estimator assigns a score from zero through four, which this page translates into a percentage meter and labels from Very Weak to Very Strong. Those categories summarize a guessability model. The English and common dictionaries help identify familiar words, while pattern information helps recognize sequences, repeats, and keyboard arrangements. Different samples of equal length can therefore receive substantially different results. A score is about the supplied text, not about whether a particular service accepts it or stores it securely.

Interpreting attack scenarios and feedback

An online attempt goes through an authentication service, whereas an offline guessing scenario assumes access to material that can be tested without making a fresh login request. The rate of guesses changes the estimated duration dramatically. This page displays several scenario labels, but its two online rows currently use the same underlying estimate, so they should not be treated as an independent comparison of throttled and unthrottled defenses. Focus on the supplied warnings and on controlled changes to the sample; an empty feedback area means the library provided no message, not that every possible weakness has been excluded.

When this tool is useful

• Compare predictable password patterns in a training example.
• Understand why a character-class checklist can overestimate a familiar password.
• Review the feedback for a disposable phrase before designing password guidance.

Tips for a better result

• Use a made-up sample when demonstrating the tool, especially while sharing a screen or recording a tutorial.
• Read the pattern feedback before changing the sample. Replacing a letter with an obvious digit may leave the underlying pattern easy to recognize.
• Treat estimates as conditional model outputs. Password reuse, phishing, malware, and recovery-account access are outside the strength meter.

Frequently asked questions