$ password-strength

⛨ local-only: runs entirely in your browser. Nothing you enter is transmitted or stored — verify in DevTools → Network, or try it in airplane mode.

Notes

Scoring uses zxcvbn, which models how attackers actually guess: dictionaries, keyboard walks, dates, l33t substitutions, and reuse patterns — not naive "one uppercase, one symbol" rules. The four scenarios matter more than the score: a password that survives a website login form may fall in seconds if a database of fast hashes leaks.