Free tool · No sign-up

How long would it take to crack your password?

Type a password below and see roughly how long a modern attacker would need to guess it — and what actually makes the difference.

The short answer is length. A long password made of ordinary words beats a short one stuffed with symbols, every time. Swapping an o for a zero doesn’t help either — attackers have known that trick for twenty years. It’s also what the NCSC recommends: three random words.

One caveat worth more than the number itself: most passwords are never cracked. They’re stolen — from a breach at some other website, or typed into a convincing fake login page. A password that scores “centuries” here is worth nothing the day it turns up in a leak, if you’ve used it twice.

We don’t store or track anything you type All the same, please don’t use your real password

Password Strength Tester

Enter your password to test: Show password

Enter a password to test

💪 How to Create a Strong Password:

Use at least 12 characters (longer is better!)
Mix uppercase letters, lowercase letters, numbers, and symbols
Avoid dictionary words, personal information, and common patterns
Consider using a passphrase with random words
Use a different password for every account
Consider using a password manager to generate and store strong passwords

Should I use the same password for multiple sites?

No—this is one of the most common and dangerous mistakes. If one site is breached, attackers often sell your login details on the dark web. Criminals then use automated tools to try your email and password on hundreds of other sites—including your business systems, email, and banking.
One password = many points of failure. Use a different password for every account.

Should I change my passwords regularly?

Only if there’s been a breach or suspicious activity. Regular forced changes can lead to bad habits like weak or recycled passwords. Focus on creating strong, unique passwords and using multi-factor authentication (MFA) wherever possible.

If there’s no MFA option, how long should my password be?

Go long. Aim for at least 16 characters. Longer passwords take dramatically more time to crack—even with powerful tools. Adding special characters (like !, %, $, or &) increases the difficulty even more.

A strong, unique passphrase is your best line of defense.

What’s the safest way to remember strong passwords?

Use a password manager. These tools securely store and autofill your logins, so you only have to remember one strong master password. It’s safer and more convenient than writing them down or reusing them.

Are password hints or security questions safe?

In most cases, no. Security questions are often easy to guess or research—especially for business owners who have information online. Details like your first pet’s name, mother’s maiden name, or favourite football team can often be found through social media, old blog posts, or public records.

Attackers specifically look for this kind of data to bypass your password entirely.

If you can, treat them like passwords. Use random answers that aren’t true but are hard to guess—like Horse$Battery!43—and store them in your password manager.

What makes a good password?

A strong password is long, random, and unique. It should avoid anything personal—like names, dates, or common phrases—and skip predictable patterns like 123456 or qwerty.

Instead, use a passphrase with a mix of upper and lowercase letters, numbers, and special characters. These are harder to crack and easier to remember than short, complex strings.

Good example:
Coffee$Train!Lemon#84

Weak example:
Password123! or Company2024!

The longer and more random your password, the stronger your defense against brute-force attacks.