Would your password survive?
Type a password like the ones you use (please not your real one). Watch how a cracking computer takes it apart, and how long it would last if a website you use got hacked.
What gave it away
Length beats complexity
Symbols and swapped letters fool people, not computers. A few random words beat them easily.
How a leak check works without seeing your password
Password managers and browsers check if your password appeared in a breach, without ever sending it. Step through how.
Your phone
Breach list server
Real leak checkers ask the Have I Been Pwned list of more than a billion leaked passwords in exactly this way. This demo sends nothing.
What to do
Four to six random words is long, strong and easy to remember.
When one site leaks, criminals try the same email and password everywhere else.
A password manager creates and fills a different strong password for every site.
Even if your password leaks, a code on your phone or UAE PASS keeps the door shut.
Times are rough estimates. Real attackers use huge lists of leaked passwords and common patterns, so a password that looks random to you may not be.
Sources and model: the times come from this page's own simple model, not from a real attack. Each password gets a guessing difficulty in bits. Passwords on a short list of the most leaked ones fall almost at once. A dictionary word counts about 11 bits (a list of a couple of thousand words), a year about 6.6 bits, a sequence 5 bits, and any other character by the size of the character set used. In a passphrase each word counts 12.9 bits, like a word picked with dice from the EFF long wordlist of 7,776 words. The time shown is the average to find it: half of all possible guesses, divided by the guessing speed. "Stolen database" assumes 10 billion guesses a second. hashcat benchmarks show one high-end graphics card making far more guesses than that against weakly stored passwords (over 200 billion a second for MD5), and far fewer against slow storage such as bcrypt (a few hundred thousand a second). The Hive Systems Password Table 2026 assumes bcrypt. "Login page" assumes about 10 guesses a second with no limit. NIST SP 800-63B requires websites to limit failed attempts, so real guessing on a login page is usually much slower. Advice: UK NCSC "three random words"; NIST SP 800-63B (length matters more than complexity, and new passwords should be checked against breach lists). Have I Been Pwned, Pwned Passwords: the range search shown above, where only the first 5 characters of the SHA-1 hash are sent.