How long would your password actually last?
Most password checkers count symbols. Attackers don’t. Type a password below to see how it holds up against real cracking methods, what it’s actually good enough to protect, and how to make a better one in about ten seconds.
Good enough for
Not good enough for
How it looks vs. how it is
Two estimates for the same password. Simple checkers count characters and assume an attacker tries every combination. Real cracking tools skip that and start with leaked passwords, words, names, years, and swaps like @ for a. The bigger the gap, the more predictable your password is.
Four ways it gets attacked
What an attacker sees
Cracking software breaks your password into pieces and guesses each piece separately. Red pieces are guessed almost instantly. Green pieces are doing the real work.
How can this check breaches without sending my password?
Your browser turns the password into a scrambled fingerprint (a SHA-1 hash) and sends only the first 5 characters of that fingerprint to the free Have I Been Pwned service. It sends back hundreds of possible matches, and your browser checks the list privately. Your password and its full fingerprint never leave this page. This check only runs when you press the button.
Stop making passwords. Pick passphrases.
The strongest password you can actually remember is a few random words strung together. Random is the key part: picked by a computer, not by you. Your brain picks favorite words, song lyrics, and pet names. Attackers know that.
Generated in your browser using its secure random number source. Nothing is stored. Use a phrase like this for the few passwords you have to remember (your password manager, your computer, your phone). Let a password manager create everything else. Prefer pen and paper? Grab the free Password Sentence Builder worksheet.
Your password isn’t the problem. Your habits are.
A perfect password used in two places is a weak password. These eight habits protect you more than any single password can. They’re in order of impact, so start at the top.
- Turn on two-step verification for your email. It takes five minutes. An authenticator app or passkey is best. Text message codes still beat nothing.
- Give your email a password it shares with nothing else. Your inbox resets everything. If it shares a password with a pizza site, the pizza site’s security is your email’s security.
- Use a password manager. The one built into your iPhone, Android, or browser is a fine start. It remembers so you don’t have to reuse.
- Stop reusing passwords on anything that matters. Start with the master keys (email, Apple/Google, bank). Let your password manager generate new ones as you go.
- Turn on two-step verification for your bank and payment apps (Venmo, PayPal, Cash App, and the rest).
- Check your email at haveibeenpwned.com. Change the password on any breached site, plus anywhere you reused it.
- Update your recovery phone and backup email. An old number can let someone else recover your account, or lock you out of it.
- Stop sending passwords by text, email, or sticky note. Most password managers can share a login securely instead.
Not every account deserves the same effort.
You don’t need to fix 120 accounts tonight. Fix them in this order. The top of the list unlocks everything below it.
The master keys
Email, password manager, Apple or Google account, phone carrier. Your email can reset every other password you have. Unique password, two-step verification, no exceptions. Do these today.
Money and work
Banking, payment apps, investments, work logins, health portals. Unique password from a password manager, two-step verification on. Work accounts put your coworkers at risk too.
Your identity
Social media, shopping sites with saved cards, cloud storage. Hijacked socials get used to scam your friends in your name. Unique password, turn on two-step where offered.
Everything else
Streaming, forums, the pizza place. Low stakes on their own. Dangerous the moment they share a password with anything above. Let your password manager generate these and forget about them.
Things you were told that aren’t true.
“P@ssw0rd!” is clever.
Swapping a for @ and o for 0 is the first trick cracking tools try. So is a capital at the start and a ! at the end. That’s the exact pattern every site’s rules push you toward, which is why attackers check it first.
Complexity beats length.
A random 8-character password using every symbol type has about 6.6 quadrillion combinations. A random 16-character password using only lowercase letters has about 6 million times more. Length wins, and long is easier to remember than weird.
A strong password makes reuse OK.
When a site leaks your password, attackers try it everywhere automatically. Strength doesn’t matter if they already have it. Reuse is the #1 way normal people get hacked.
Change every password every 90 days.
Forced changes lead to Summer2025! becoming Fall2025!. Current NIST guidance says change a password when there’s a reason (a breach, a suspicion), not on a calendar.
Nobody wants my account.
Nobody is targeting you personally. They’re targeting everyone at once with automated tools. Your email, your saved card, and your contacts list are all worth money to someone.
Writing passwords down is always bad.
A notebook in your home is safer than reusing one password everywhere. A password manager is better than both. A sticky note on your work monitor is still a bad idea.
Now lock down the rest.
The 10-Minute Lockdown: six things in ten minutes that get you out of the easy-target pool for good. Plain English. Specific steps. No scare tactics.
Get the free checklistCrack times are estimates using the open-source zxcvbn model from Dropbox, which guesses passwords the way cracking software does. Real attacks vary with the attacker’s hardware and how the breached site stored passwords. Treat these numbers as a reality check, not a guarantee. A strong password is one layer. Two-step verification is the next one.