Offline Password Strength Estimator
Estimate guessing difficulty with local English and Chinese dictionaries, common patterns and optional personal context.
Patterns before character rules
The local zxcvbn-ts 4.2.0 engine looks for common passwords, dictionary words, names, dates, repeats, sequences and keyboard patterns. It uses pinned common, English and Chinese data; traditional-Chinese entries are derived with OpenCC. The score ranges from 0 to 4 and is an estimate, not a pass/fail certificate.
Optional context words represent names, handles or project words that an attacker might know. Separate up to 50 words with commas or newlines, at most 100 UTF-16 units each. They affect the estimate but are excluded from the report. Input is limited to 256 Unicode code points and 512 UTF-16 units.
How to read the result
Guesses and scenario times describe the engine’s model of guessing attacks, not a measured time for your actual account. Rate limiting, the server’s password-hashing cost, dictionary coverage and attacker knowledge can change the result substantially. Multilingual and uncommon scripts are especially hard to estimate reliably.
The exported report contains score, estimates, pattern categories and positions, with no plaintext password, matched tokens or context words. The visible password field still contains what you typed until you clear it. No breach database or remote password service is queried.
Reference
Questions & answers
Does a score of 4 mean a password is safe?
No. A model cannot know reuse, compromise, phishing or every language pattern. Use the result as diagnostic feedback.
Can I check whether the password has leaked?
No. This tool deliberately performs only local estimation; a dictionary match is not evidence of a breach.
Is my input uploaded?
No. Processing runs in your browser. Engines load from this site; the tool does not send input to a processing API or save it. Clear removes the visible input and result.