Password strength questions, answered
Is it safe to type my password into a strength checker?
This one never sends your password anywhere. The check runs entirely in your browser, and nothing you type is sent to us or to anyone else. The optional breach check sends only the first five characters of the password's SHA-1 hash, never the password.
How does the checker estimate crack time?
It uses zxcvbn, the open-source estimator originally built at Dropbox, which looks for the shortcuts attackers really use: common passwords, dictionary words, names, dates, keyboard patterns, repeats and letter-for-symbol swaps. It counts the guesses needed and shows the time at a trillion guesses a second, an attacker holding a leaked password database, and at 100 guesses an hour, someone guessing at a login page.
Why does my password with symbols still score as weak?
Because attackers don't guess one character at a time. A familiar word with a capital letter, a number and a symbol on the end, like Summer2024!, follows a pattern cracking tools try early. Length and genuine randomness matter far more than symbols.
What does the breach check do?
It looks the password up in Have I Been Pwned's list of passwords exposed in data breaches. Your browser sends only the first five characters of the password's SHA-1 hash and compares the matches itself, so the password never leaves your device. A password found there should never be used again, however strong it looks.
How do I make a strong password?
Let a generator pick it. Use 16 or more random characters, or eight or more random words if you need to type it, and use a different password for every account. A password manager remembers them for you.