Estimate password guessability locally using pattern-aware English and common dictionaries, with actionable feedback.
Memory-only processing. Reset clears this workspace. No password recovery or breach lookup.
No estimate yet.
zxcvbn-ts uses common/English dictionaries and keyboard graphs locally. Score 0–4 and log10 guesses are model estimates, not guarantees or breach checks. Up to 128 UTF-16 code units; no silent truncation. Results expose generic pattern names, not matched tokens. Inputs are not persisted or sent to analytics. JavaScript memory cannot guarantee secure string erasure.
Processing uses your browser memory. Inputs are not included in page analytics. Text tools accept up to 200,000 UTF-8 bytes unless a tighter limit is stated. Worker operations time out after 45 seconds and can be cancelled. Clipboard and downloads require an explicit action.
Enter your values locally; no inputs are uploaded.
Check validation feedback before reviewing the browser-generated result.
Review the explanation, copy supported outputs or reset the workspace.
The local zxcvbn-ts model uses common and English dictionaries, keyboard graphs, repetitions, sequences and other patterns to estimate guesses. It does not simply count character classes.
zxcvbn-ts uses common/English dictionaries and keyboard graphs locally. Score 0–4 and log10 guesses are model estimates, not guarantees or breach checks. Up to 128 UTF-16 code units; no silent truncation. Results expose generic pattern names, not matched tokens. Inputs are not persisted or sent to analytics. JavaScript memory cannot guarantee secure string erasure.
Processing takes place locally in browser memory. Inputs are not sent to a processing service, persisted by this tool or included in analytics. Ordinary page requests may still be logged. Clipboard and downloads require explicit actions.
The local zxcvbn-ts model uses common and English dictionaries, keyboard graphs, repetitions, sequences and other patterns to estimate guesses. It does not simply count character classes.
It is a coarse model rating from very weak to strong estimate. It is neither a universal crack-time prediction nor a guarantee that a password is unique, uncompromised or appropriate for every account.
No. It runs local dictionaries and pattern matching without sending the password to a lookup or analytics service. A strong model score does not establish that a password has never leaked.
Common replacements such as numbers for letters often match dictionary patterns. The result can identify predictable substitutions without echoing the matched password token into the feedback.
The estimator supports up to 128 UTF-16 code units and rejects longer values without silent truncation. Unicode character count in the result counts code points, which can differ from UTF-16 length.
Use Reset / Clear to cancel pending work, clear the password control and discard the result. The tool does not save input in storage or the URL. Browser-managed or JavaScript string memory cannot be guaranteed securely erased.