Password strength checker

It guesses the way a cracking program does. It looks for the parts of your password an attacker would try first: common passwords, words and names (also with symbol swaps, capitals or spelled backwards), keyboard patterns, sequences, repeats, years and dates. Anything left over is treated as random characters. It then adds up the cheapest way to guess the whole thing, which gives the estimated number of guesses, the score and the crack times.

The check runs on your device, in this page. Your password is never sent to Trezio or anyone else, never saved (not even in your browser's storage) and never added to the page address, and the field is cleared when you leave the page. If you'd rather not type a real password into any website, check one built the same way instead: same length, same kinds of words and characters.

It depends on the attack, so the checker shows two. An online attack guesses through a site's login page, about 10 guesses a second at most. An offline attack happens after a site's password database is stolen: attackers then guess on their own hardware, and with a fast hash that can be 10 billion guesses a second. A password that survives the offline attack is strong.

Length and unpredictability. Four or five random words, or 12 or more random characters, take an attacker a very long time to guess. A real word with a capital at the start and a number or symbol at the end does not, because that is exactly what cracking programs try. A strong password is also unique: use it for one account only.

Because the symbols are in predictable places. Swapping a for @ or o for 0, capitalizing the first letter and adding 1 or ! at the end are the first tricks attackers try, so P@ssw0rd is barely harder to guess than password. Adding another uncommon word helps far more than adding symbols.

No, it's an estimate. The checker knows the 2,000 most common passwords and several thousand common words and names; real attackers use far bigger lists, including passwords leaked in past breaches. A password that has leaked anywhere is weak whatever its score. Never reuse a password across sites, and turn on two-step verification where you can.

This page checks a password and forgets it. Trezio saves your links, notes and screenshots, and includes an encrypted vault for logins: they are encrypted on your device with AES-256-GCM, using a master password that never leaves it. You set up the vault in the Trezio Chrome extension or Android app, and can unlock your saved logins in the web app. There's a free plan.