# passwordstrength.net

> A free, privacy-first password security toolkit: a zxcvbn-powered strength checker, password/passphrase/WiFi/PIN generators, a bulk password auditor, a 2FA/TOTP QR generator, and a policy compliance checker — plus 23 in-depth guides, a 98-question FAQ, and a 200-term glossary covering password security, entropy, breach response, and authentication.

Every tool on this site runs entirely client-side in the visitor's browser. No password, PIN, WiFi key, or 2FA secret you type into any tool is ever transmitted to a server, logged, or stored — the JavaScript that scores, generates, or audits your input executes locally and the page works the same with the network disconnected. This is a deliberate design choice, not a claim to take on faith: view-source on any tool page shows no fetch/XHR call carrying user-entered secrets.

The strength-checking logic is built on zxcvbn, the pattern-matching entropy estimator originally developed at Dropbox, rather than naive character-class counting (the "must contain 1 uppercase, 1 number, 1 symbol" rules that guidance bodies like NIST now advise against). Guidance across the site's tools and articles is cross-checked against current official standards — NIST SP 800-63B-4, PCI DSS v4.0, ISO/IEC 27001, IETF RFC 6238/4226/4648, Wi-Fi Alliance WPA3 documentation, OWASP cheat sheets, and CISA/NCSC public guidance — with source links included on every tool page.

## Core Tools

- [Password Strength Checker](https://passwordstrength.net/passwordstrengthchecker.html): Real-time password strength scoring via zxcvbn — crack-time estimate, pattern detection, and improvement suggestions. No character-counting rules.
- [Password Generator](https://passwordstrength.net/passwordgenerator.html): Generates strong random passwords or diceware-style passphrases with adjustable length and character sets.
- [Bulk Password Audit](https://passwordstrength.net/bulk-password-audit.html): Paste or upload a list of passwords for batch strength scoring, common-password matching, and an optional breach check.
- [PIN Strength Checker](https://passwordstrength.net/pin-strength-checker.html): Flags 4–6 digit PINs that are common, sequential, repeated, or match predictable patterns like birth years or keypad shapes.
- [PIN Generator](https://passwordstrength.net/pin-generator.html): Generates a random 4, 5, 6, or 8-digit PIN, automatically rejecting common PINs, keypad shapes, dates, and repeating patterns.
- [WiFi Password Generator](https://passwordstrength.net/wifi-password-generator.html): Generates a strong WPA2/WPA3-appropriate router password with a scannable QR code for guest access.
- [2FA / TOTP QR Code Generator](https://passwordstrength.net/two-factor-qr-generator.html): Creates a standards-based (RFC 6238) TOTP secret and QR code, with a live code to verify it works in any authenticator app.
- [Batch Password Generator](https://passwordstrength.net/batch-password-generator.html): Generates a list of strong random passwords or passphrases at once, downloadable as a .txt file.
- [Password Policy Compliance Checker](https://passwordstrength.net/password-policy-checker.html): Define a custom password policy (length, character types, banned words) and check passwords against it individually or in bulk.
- [Free Online Tools Directory](https://passwordstrength.net/tools.html): Index of this site's tools alongside other free browser-based utilities.

## Learning Resources

- [How It Works](https://passwordstrength.net/how-it-works.html): Explains the zxcvbn scoring engine, entropy calculation, and crack-time estimation methodology used across the site's tools.
- [FAQ](https://passwordstrength.net/faq.html): 98 searchable questions and answers covering password strength, generators, breach checking, PINs, WiFi security, 2FA/TOTP, and policy compliance, fact-checked against NIST and PCI DSS.
- [Glossary](https://passwordstrength.net/glossary.html): 200 searchable, accuracy-checked definitions spanning cryptography, password generation, breach auditing, PINs, WiFi security, 2FA/TOTP, and compliance terminology.
- [About](https://passwordstrength.net/about.html): The site's privacy-first design philosophy and background.
- [Privacy Policy](https://passwordstrength.net/privacy.html): Plain-English explanation of what is (and is not) collected — no password data is ever stored or transmitted.

## Blog Articles

- [Your Strong Password Isn't Enough: The Case for 2FA](https://passwordstrength.net/blog-2fa.html)
- [What to Do Immediately After Your Data Is Breached](https://passwordstrength.net/blog-after-a-breach.html)
- [AI-Powered Password Cracking: How Much Faster Does It Make Attacks?](https://passwordstrength.net/blog-ai-cracking.html)
- [Best Authenticator Apps in 2025: Ranked and Reviewed](https://passwordstrength.net/blog-authenticator-apps.html)
- [The Biggest Password Breaches in History — and What We Learned](https://passwordstrength.net/blog-biggest-breaches.html)
- [Most Common Passwords of 2024 — Analyzed from Real Breach Data](https://passwordstrength.net/blog-common-passwords.html)
- [Your Passwords on the Dark Web: How to Find Out and What to Do](https://passwordstrength.net/blog-dark-web-passwords.html)
- [Diceware: The Old-School Method That Still Makes the Strongest Passwords](https://passwordstrength.net/blog-diceware.html)
- [Entropy 101: Understanding Password Strength in Plain English](https://passwordstrength.net/blog-entropy.html)
- [Hardware Security Keys Explained: Are They Worth It?](https://passwordstrength.net/blog-hardware-keys.html)
- [Teaching Kids About Password Safety: A Parent's Guide](https://passwordstrength.net/blog-kids-online-safety.html)
- [How to Create a Strong Password You Can Actually Remember](https://passwordstrength.net/blog-memorable-strong.html)
- [Passkeys Explained: Is This the End of Passwords?](https://passwordstrength.net/blog-passkeys.html)
- [5 Rules for Building a Passphrase That's Actually Secure](https://passwordstrength.net/blog-passphrase-tips.html)
- [Passphrases vs Passwords](https://passwordstrength.net/blog-passphrases.html)
- [Why "P@ssw0rd!" Still Gets You Hacked](https://passwordstrength.net/blog-passw0rd.html)
- [How to Pick a Password Manager (and Which Ones We Trust)](https://passwordstrength.net/blog-password-manager.html)
- [10 Password Mistakes You're Probably Still Making](https://passwordstrength.net/blog-password-mistakes.html)
- [Password Policies for Teams: What Actually Works in 2025](https://passwordstrength.net/blog-password-policies.html)
- [The 2024 RockYou2024 Breach: 10 Billion Passwords in the Wild](https://passwordstrength.net/blog-rockyou2024.html)
- [How to Secure Your Email Account: The Complete Guide](https://passwordstrength.net/blog-secure-email.html)
- [SIM Swapping Attacks: What They Are and How to Protect Yourself](https://passwordstrength.net/blog-sim-swapping.html)
- [Blog Index](https://passwordstrength.net/blog.html): Full archive of the above, filterable by topic (Guides, Security News, Password Tips, Passphrase, 2FA, Data Breaches).

## Reference Data

- [Glossary (DefinedTermSet)](https://passwordstrength.net/glossary.html): 200 terms across cryptography, generation, auditing, PINs, WiFi, 2FA/TOTP, automation, and compliance.
- [FAQ (FAQPage)](https://passwordstrength.net/faq.html): 98 question/answer pairs, searchable and cited against NIST SP 800-63B-4, PCI DSS v4.0, and related standards.
- Official standards referenced across tool and article source sections: NIST SP 800-63B-4, NIST SP 800-153, PCI DSS v4.0, PCI PIN Security Requirements, ISO/IEC 27001:2022, ISO 9564-1:2017, IETF RFC 6238 (TOTP), IETF RFC 4226 (HOTP), IETF RFC 4648 (Base32), IETF RFC 4086 (Randomness), Wi-Fi Alliance WPA3 documentation, FIDO Alliance specifications, W3C WebAuthn Level 3, OWASP Authentication and Credential Stuffing Prevention Cheat Sheets, CISA "Use Strong Passwords," and NCSC UK password guidance.

## Common Questions Answered on This Site

- What actually makes a password strong — length or complexity rules?
- How is "crack time" calculated, and why do estimates vary between tools?
- Is it safe to check a password's strength or breach status online?
- What is entropy, and how many bits of entropy is "enough"?
- How do TOTP/2FA codes work, and how is a QR code generated safely client-side?
- What makes a WiFi router password secure under WPA2/WPA3?
- Why do security bodies now recommend against forced periodic password rotation?
- How does a PIN get flagged as "common" or "predictable"?
- What should I do in the first 30 minutes after learning I'm in a data breach?

## Privacy and Approach

- No password, passphrase, PIN, WiFi key, or 2FA secret entered into any tool on this site is ever sent to a server, logged, or stored — every tool runs entirely in the browser via client-side JavaScript.
- The site sets no tracking cookies tied to the content of what you type into a tool; see the [Privacy Policy](https://passwordstrength.net/privacy.html) for full detail.
- Every generator and checker states its methodology and links its sources directly on the tool page rather than asking for trust on faith.

## Site Information

- Full-text version of this site for AI ingestion: [llms-full.txt](https://passwordstrength.net/llms-full.txt)
- XML sitemap: [sitemap.xml](https://passwordstrength.net/sitemap.xml)
- Contact: [Contact page](https://passwordstrength.net/contact.html)