Password strength checker
How long would it take to crack your password?
Type a password to see how fast a real attacker could guess it, which patterns give it away, and whether it has shown up in a data breach.
Scored in your browser. What you type is never sent or saved.
Waiting for a password
How long to crack a password, by length
Time to try every combination of a truly random password at about a trillion guesses a second — a multi-GPU rig against a leaked database stored with a fast hash like MD5. Passwords people choose themselves fall much faster than this, because guessers try human patterns first.
| Length | Numbers only | Lowercase letters | Upper and lowercase | Letters and numbers | Letters, numbers, and symbols |
|---|---|---|---|---|---|
| 6 | Instantly | Instantly | Instantly | Instantly | Instantly |
| 8 | Instantly | Instantly | 53 seconds | 3 minutes | 1 hour |
| 10 | Instantly | 2 minutes | 1 day | 9 days | 1 year |
| 12 | 1 second | 1 day | 12 years | 102 years | 17 thousand years |
| 14 | 1 minute | 2 years | 33 thousand years | 393 thousand years | 155 million years |
| 16 | 2 hours | 1.4 thousand years | 91 million years | 1.5 billion years | Longer than the age of the universe |
| 18 | 11 days | 934 thousand years | Longer than the age of the universe | Longer than the age of the universe | Longer than the age of the universe |
| 20 | 3 years | 631 million years | Longer than the age of the universe | Longer than the age of the universe | Longer than the age of the universe |
Numbers only never hold up. From 12 characters with mixed types, a random password outlasts any realistic attack, and from 16 it is out of reach. Make one with the password generator.
Can AI crack passwords faster?
Research tools such as PassGAN train a model on leaked passwords so it learns how people actually build them: a
name, a year, a capital first letter, a symbol on the end, a swapped for @. The model
then guesses those shapes first.
That does not make the hardware any faster. It makes the guesses smarter, and that hurts human-made passwords most. This checker scores your password the same way: it hunts for words, names, years, keyboard runs, and symbol swaps, and prices the password by its cheapest weakness rather than its length alone.
The defence is simple. A random password or a passphrase of random words has no human pattern for a model to learn. Give every account its own, and an AI guesser has nothing to work with.
In practice, AI is used far more to trick people into handing passwords over than to crack them. See the AI scams targeting gamers, from deepfake giveaways to cloned voices.
The three attack speeds
- Guessing at a login page. About 10 guesses a second, before rate limits kick in.
- Leaked database, strong hashing. About 100,000 guesses a second against bcrypt on a GPU rig.
- Leaked database, weak hashing. About a trillion guesses a second against MD5 or SHA-1 on a multi-GPU rig.
The headline number is the worst case. You cannot see how a site stores your password, and old databases often use fast hashes. Assume the worst and a strong password still holds.
What to do if your password is weak or leaked
- Change it on every site where you used it, starting with your email.
- Use a different random password for each account. A leak on one site then stays on that site.
- Turn on two-factor authentication. Keep the setup key safe; you can make codes with the 2FA code generator.
- Save each login with its recovery email and backup codes in a password manager for games.
Already locked out? Follow the steps for a hacked Epic Games account, a hacked Roblox account, or a hacked Discord account.
Password strength questions
- Is it safe to type my password into this checker?
- The score is worked out in your browser and nothing you type is sent or saved. The optional leak check sends only the first 5 characters of a SHA-1 hash to Have I Been Pwned, which cannot turn that back into your password. If you would rather not type a real password, test one built the same way.
- How accurate is the time to crack?
- It is an estimate, and it leans cautious. The checker looks for the shortcuts real guessers use — common passwords, words, names, years, keyboard runs, and symbol swaps — and scores the cheapest way to guess your password, not just its length.
- Can AI crack my password?
- AI-trained guessers learn how people build passwords from leaked lists, so they find human patterns sooner. They do not speed up the hardware. A truly random password or a passphrase of random words gives them nothing to learn from.
- Why does my password with symbols still score weak?
- Because the symbols are in predictable places. Summer2024! is a word, a year, and an exclamation mark, and guessers try that shape early. Length and randomness matter far more than adding a symbol at the end.
- What does bits of guesswork mean?
- Each bit doubles the number of guesses needed. 40 bits is about a trillion guesses, which a GPU rig can try in seconds against a weakly hashed leak. 80 bits or more is out of reach for any known attacker.
More free tools
- Password generator Random 12, 16, or 20-character passwords and easy-to-type passphrases.
- 2FA code generator Paste a setup key and get the current authenticator code.
- Free temp mail A disposable inbox for one verification code. No signup.
- AI username generator Describe a vibe and get AI names that fit Roblox, Fortnite, Xbox, PSN, and Discord rules.
- Roblox username generator Roblox names with 3–20 characters and at most one underscore.
- Fortnite name generator Sweaty, funny, and clean Epic display names of 3–16 characters.
Keep the login, not just the idea
LoginScout is a private vault for gaming logins. Keep every Steam, Epic, Roblox, and Riot account with its password, 2FA codes, and recovery notes, encrypted on your device. Free for 5 accounts.