Loading tools
Loading tools
Loading tool
8 weakness patterns, 4 attacker tiers, zxcvbn-style scoring.
A password strength checker scores how hard your password is to crack. This one runs zxcvbn-style analysis: base entropy from character classes and length, minus penalties for dictionary words, leet substitution, sequences, repeats, dates, and common-list hits. The score maps to crack-time estimates at four real-world attacker tiers, from rate-limited login forms (100 guesses/sec) to nation-state ASIC farms (100 trillion/sec).
Most strength meters are too lenient (color-coded green for "p@ssw0rd!" because it has 4 character classes). This one models real cracking behavior: leet substitution gives almost no security, "password1" is one of the first 100 guesses, and length matters more than special characters. Everything runs in your browser. Your password never leaves the page.
Most checkers turn green at 8 chars + 1 digit. We score by entropy minus pattern penalties, like real crackers do. P@ssw0rd! still rates very weak.
Same password is "10 hours" against an online form and "instantly" against a stolen hash + GPU. The threat model matters; we show all four.
Kaspersky's checker is fine but ships your password to their server for analysis. We don't even have a server endpoint. The math runs in your tab.
Generic 'use a stronger password' is useless. We tell you exactly which pattern to fix, with examples.
| Feature | Molixa | Kaspersky | How Secure Is My Password | UIC |
|---|---|---|---|---|
| Realistic scoring (penalty-based) | Yes, 8 patterns | Lenient | Lenient | Charset only |
| 4 attacker tiers | Yes | 1 tier | 1 tier | 1 tier |
| Specific weakness explanation | Yes | Generic | Generic | Generic |
| Targeted suggestions | Per weakness | Generic | Generic | None |
| Free, no signup | Yes | Yes, ads | Yes, ads | Yes |
| Browser-only | Yes | Server-side | Server-side | Yes |
Yes. Unlimited use, no signup, no daily cap. The whole analysis runs in your browser. Kaspersky's checker is free but ad-supported and ships your password to a server; we don't.
No. The strength analysis is 100% browser-side. Your password text never leaves the page. We don't have an API call to send it anywhere even if we wanted to.
We compute base entropy from charset (lower / upper / digit / symbol) and length, then subtract penalties for weakness patterns (dictionary words, leet substitution, sequences, repeats, dates, common-list hits). Final score is 0-4 like zxcvbn, mapped to crack-time estimates at 4 attacker tiers.
Online (throttled, 100 guesses/sec, e.g. a login form with rate limiting), online (fast, 1M/sec, weak rate-limit), offline GPU (1T/sec, stolen hash + modern GPU), offline ASIC farm (100T/sec, nation-state hardware). Real-world attackers are usually tiers 2-3.
Leet substitution (0 for o, @ for a) is reversed by every cracker in milliseconds. The underlying word 'password' is in the top-10 most-common list. Real entropy is the same as 'password' itself, which is none.
Four to five unrelated random words like 'correct horse battery staple' (the famous xkcd example). Easy to remember, but the entropy comes from the word combinations, not the character set. 4 random words from a 7000-word list = ~52 bits, equivalent to ~9 random characters.
Depends on what's at stake. For a throw-away forum: yes. For your bank: 14+ with full diversity (upper, lower, digit, symbol). For a master password: 18-20 random chars or a 5-word passphrase. Length is the single biggest factor.
Yes. Each character class doubles the search space per character. A 12-char lowercase password has 26^12 = 95B possibilities. Same length with all 4 classes has 95^12 = 5.4e23. That's 10 trillion times more search space.
Yes. Crackers try the top 10K passwords first, then dictionary attacks with leet substitution, then keyboard patterns (qwerty, 1qaz2wsx), then names + dates. If your password matches any of those patterns it's cracked in under a second offline.
Yes. 1Password, Bitwarden, KeePass generate 24-char random passwords with full character diversity. You only need to remember one strong master password. The convenience-vs-security trade-off favors managers for 99% of people.
8 weakness patterns, 4 attacker tiers, browser-only. Free unlimited.
Open the password checkerThe Password Strength Checker page is built, reviewed, and maintained by the Molixa team. We use the tool we ship and update the docs when the behavior changes.