비밀번호 강도 검사기

How it is checked

The checker is zxcvbn, the estimator many sign-up forms use. It looks for what attackers try first: the 30,000 most common passwords, keyboard patterns such as "qwerty", sequences such as "abcd" or "1234", repeats, dates and years, letters swapped for look-alikes ("p@ssw0rd"), and the words about you that you add.

It then estimates how many guesses the password would take, and how long that is in four situations, from a website that limits tries to a stolen database with weak protection.

Good to know

• It is an estimate. A strong rating means the password has no pattern attackers commonly try, not that it is unbreakable.
• A password that uses the words about you is rated Fair at most, however long it is: anyone who knows you, or finds you online, would try those first.
• It doesn't know every word in every language, so a single real word with small changes may look a little stronger than it is.
• It can't tell whether a password has appeared in a data breach: that would mean sending it, or part of its hash, to another website, and this page sends nothing.
• The best passwords are long and random: four or more random words, or one made by a password manager or the Password Generator.

Your password stays on your device

The check runs in your browser. The password is never uploaded, stored or logged, and this site's security policy blocks the page from sending anything anywhere.