password strength checker · strong password · time to guess
Password strength check: how strong is yours, and what makes a strong password
Type a password you plan to set.
Nothing you type here is sent to us or stored. Test a password you are about to set, or an old one — not the one that opens your account today.
- Computed in your browser
- Length beats symbols
- Reuse undoes strength
- Length
- —
- Time to guess, order of magnitude
- —
The check asks Pwned Passwords, the breach database of Have I Been Pwned. Your browser hashes the password and sends only the first 5 characters of the hash. How it works
The estimate is worked out inside this page from its length and from the patterns guessing programs try first: common passwords, a word plus digits, keyboard runs, years. It is an order of magnitude under a stated assumption, not a measured time. The same field can then look the password up in breach data.
- The estimate is computed in your browser and is not sent anywhere
- Length counts for more than symbols: NIST's minimum for a password used on its own is 15
- A strong password that is reused is still one leak away from being known
Four examples
Password strength in four examples
Each example is scored by the same calculation as the field above — the bars and the time are computed in your browser, not written into this page.
Compare the second and the fourth. One has a capital, a symbol and digits and looks “complex”. The other is plain lowercase words. The estimate goes the other way, and the standard explains why: people answer composition rules predictably, and length is what adds guesses.
qwerty12345—A keyboard run from the list of most-used passwords, with digits added in order. It is tried right after the list itself.
Diwali@2025—Capital, symbol, digits — and the most familiar shape there is: one word, a symbol, a year. It is guessed with a dictionary, not character by character.
k7#Qm2!x—Eight random characters of every kind. Nothing to find in a dictionary, but eight is short: the whole space can be worked through.
copper-window-tuesday-orbit-mango—Five unrelated words. Easy to type on a phone, and long enough that guessing stops being practical.
The time assumes someone holds a stolen hash of the password and makes ten billion guesses per second. That speed is an assumption of this estimate, not a measured fact about Instagram, TikTok or anyone else. Read “days” or “centuries” as an order of magnitude.
How it is calculated
What the password strength estimate depends on
The starting point is the number of possible passwords of that length built from the kinds of characters you used. Every added character multiplies it, which is why length moves the result more than swapping a letter for a symbol. NIST says the same in its guideline: password length is a primary factor in characterising password strength.
Then the number is cut down for whatever a guessing program would try before it goes character by character. Those checks are listed below, and each one that applies is shown under the field.
The time is that number divided by an assumed speed — ten billion guesses per second against a stolen hash, the worst case. Real speeds depend on how a service hashes passwords, and we do not know that for the platforms. So the result is a scale — seconds, days, centuries — and never a promise.
What the estimate cannot see: whether the word is your name or your city, whether the password is already in breach data, whether five sites share it. The breach question has its own button under the field. The other two only you can answer.
- The password is on a list of most-used passwords, or is one of them with a few characters added
- One dictionary word plus a few digits or symbols
- A keyboard or alphabet run: qwerty, abcd, 1234
- The same character repeated
- A year — flagged, because years and dates are standard guesses
- Several words in a row are counted as words from a word list, not as separate letters
Who advises what
Strong password rules: NIST, CISA, Instagram and TikTok side by side
On two points — composition and scheduled changes — the platforms' advice contradicts the current US standard. We name the difference and follow the standard.
| Question | NIST SP 800-63B-4, 2025 | CISA | Instagram help | TikTok help |
|---|---|---|---|---|
| Minimum length | 15 characters where the password is the only factor; 8 as one part of a multi-factor login. Services must accept at least 64. | 16 or more. | 6 allowed, 8 or more recommended. | 12–15 characters. |
| Capitals, digits, symbols | Services must not impose composition rules. | Random, or a phrase of 4–7 unrelated words. | A mix of numbers, letters and special characters. | Upper and lower case, numbers and symbols. |
| Changing it on a schedule | Services must not require periodic changes. A change is required when there is evidence of compromise. | No such advice on its page. | “Change your password regularly.” | Every 30 days. |
| Checking against breached passwords | Required of services for every new password. | Not covered on its page. | Warns when a password may have been exposed. | Reviews published stolen lists and asks for a change on a match. |
| Password managers | Services must allow them, and autofill. | Advised. | Not mentioned in the article we read. | Not mentioned in the article we read. |
NIST writes for services and CISA for people; neither binds Instagram or TikTok. But NIST gives its reasons. People respond to composition rules predictably — its own example is “Password1!”. And a password should be replaced when there is evidence it was exposed, not because a month has passed. On both points this site follows NIST and CISA.
Build one
How to make a strong password you can still type
- 1
Go long: 15 characters or more
NIST's minimum for a password used on its own is 15; CISA advises 16 or more. NIST adds that people should be encouraged to make passwords as long as they want, within reason.
- 2
Use a phrase of unrelated words, or let a password manager generate it
CISA: random, or a phrase of 4–7 unrelated words. NIST notes that passphrases are often an effective way to get a longer password, and says services should accept spaces.
- 3
Drop the patterns the estimate flags
A common password with digits added, a word plus a year, a keyboard run: each is guessed as one unit, whatever symbols decorate it.
- 4
One password, one account
Instagram's help: not the password you use for email or banking. CISA: a different one for each account. Remembering that many is the password manager's job, not yours.
- 5
Test it, then check it against breaches
Put it through the field at the top before you set it.
You should see: an estimate of years or longer, and “Not found in the breach database”.
- 6
Add a second factor
Length does not help on a fake login page: a long password is handed over there as easily as a short one. With a second factor, the password alone is no longer enough to log in; the methods and where to switch them on are on two-factor authentication.
Under the field
How the strength check works: scored on the page, nothing sent
The estimate is computed by this page's own script while you type. It reads only the characters in the field: how many there are, which kinds appear, and whether they fall into one of the patterns listed above. Scoring makes no network request, and the password is not stored — a reload clears it.
That is also its limit. The estimate knows how a guessing program would approach the string; it cannot know whether that exact string has already leaked. A leaked password is tried as it is, so a long one that sits in breach data is no safer than a short one.
Leaks are answered by the second button under the field. It is a separate step with its own mechanics and three possible answers, all explained on the password leak check page.
Questions
Strong password: short answers
How long should a strong password be?
NIST's 2025 minimum for a password that is the only thing protecting an account is 15 characters. CISA advises 16 or more. Instagram accepts 6 and recommends 8 — that is what the service allows, not what is strong.
Is a short password with symbols stronger than a long plain one?
Usually not. Each extra character multiplies the number of guesses; a symbol in a familiar place adds little, because the familiar places are tried first. NIST tells services not to demand mixtures of character types at all.
Should I change a strong password regularly?
NIST says services must not require periodic changes; a password is changed when there is evidence it was exposed. Instagram advises changing it regularly and TikTok every 30 days. We follow NIST on this and say so.
The checker says “centuries”. Can I rely on that?
Rely on the scale, not the word. The time assumes ten billion guesses per second against a stolen hash — our assumption. And it says nothing about a password that is already in a breach or typed into a fake page.
Eight random characters scored low. Why?
Because eight is short. Every kind of character is there, yet the number of possible eight-character strings is small enough to be worked through at the speed this estimate assumes. NIST sets 15 as the minimum for a password that is the only factor, and accepts 8 only as one part of a multi-factor login.
Are passkeys stronger than a strong password?
TikTok's help describes passkeys as more secure than passwords, and Facebook's help offers to create one. Our reading on passkeys goes no further than those two statements.
Take it with you
Save this page as your own plan
Print the page or save it as a PDF to keep the steps next to your phone while you go through the settings. Anything typed into the password field is cleared first and never printed.
- The printout opens every route and every answer on this page in full
- The file is made by your own browser — nothing is uploaded
- This site does not log in to anyone's account and asks for no username