Question 1

What is zxcvbn?

Accepted Answer

zxcvbn is a password strength estimator built by Dropbox engineer Daniel Lowe Wheeler in 2012. Unlike traditional checkers that count character classes (must have uppercase, must have digit), zxcvbn estimates how many guesses a realistic attacker would need based on dictionaries, common patterns, leetspeak substitutions, sequences, repeats, and dates. A password like 'Tr0ub4dor&3' that passes typical complexity rules gets a low zxcvbn score because the attack pattern is well-known, substitute common letters, add a year. zxcvbn powers strength meters in Dropbox, Bitwarden, 1Password, and most modern password tools.

Question 2

What does the 0-4 score mean?

Accepted Answer

0 = too guessable (in top 10^3 most common passwords). 1 = very guessable (top 10^6, a single laptop cracks it in minutes). 2 = somewhat guessable (top 10^8, a small budget GPU rig cracks it). 3 = safely unguessable for online attacks (top 10^10, needs serious offline hashcat budget). 4 = very unguessable (10^10+). Aim for 3 or 4 for any password you care about. The score combines all weakness patterns zxcvbn knows about, a password that's long but contains 'password' as a substring gets penalized regardless.

Question 3

Why four different crack-time estimates?

Accepted Answer

Different attack scenarios produce very different times. Online rate-limited (100 guesses/hour) is what happens when an attacker is hitting your website's login form, typical rate limiting makes even 6-character passwords reasonably safe. Online no-rate-limit (10/sec) is broken or absent rate limiting, slightly more serious. Offline slow-hash (10K/sec) is the attacker stole your database and you used bcrypt/Argon2, even modest passwords are safe here. Offline fast-hash (10 billion/sec) is the worst case: stolen database, unsalted SHA-256, only long random passwords survive. The same password's safety varies by ~9 orders of magnitude depending on which scenario.

Question 4

Is zxcvbn perfect?

Accepted Answer

No. zxcvbn's dictionary is fixed (10K common passwords, ~30K English words, ~10K names) and doesn't include newer breach data. A password that's not in the dictionary may score higher than it deserves if it follows a common pattern not yet captured. zxcvbn also doesn't know your specific username, your company name, or context-specific weak words, it can't detect 'companyname2024'. For most practical purposes it's the best password strength meter available. The 'zxcvbn-ts' fork adds newer dictionaries but isn't always drop-in compatible.

Password Strength Checker

Frequently Asked Questions