Password Crack Clock

How the clock works

The estimator is zxcvbn — the industry-standard password strength model, running entirely on your machine. It doesn't just count character sets; it models how crackers actually attack: dictionary words, names, leetspeak swaps (pa55word), keyboard walks (qwerty), dates, repeats, and the rockyou-style lists of passwords humans actually use.

The four clocks above are throughput assumptions, worst-case honest: from a polite login form (100 tries/hour) to a leaked database with no salt thrown at a rack of GPUs (10 billion guesses/second). If your password survives the last clock, it survives everything above it.

What actually makes passwords strong

• Length beats cleverness. Four random words (polar-vinegar-donkey-raft) outmuscle P@ssw0rd! by orders of magnitude.
• Uniqueness beats rotation. Reusing a password means one leak opens every door. A password manager remembers so you don't have to.
• Random beats pattern. Your cat's name + your birth year is in every cracker's wordlist.

FAQ

Is my password really not sent anywhere?

Really. This page makes zero network calls with your input — open your browser's network tab and watch it stay silent while you type. The entire estimator shipped with this page. You can disconnect from the internet and it keeps working.

Should I change my password every 90 days?

Modern guidance (NIST 800-63B) says no — forced rotation pushes people toward Summer2024! → Summer2025!. Change passwords when a service reports a breach, and make the new one long and unique.

What about "correct horse battery staple"?

Yes — that's the passphrase pattern, and it genuinely works. Random uncommon words strung together are long AND memorable. Just don't pick the famous example; it's in every wordlist now.

Is checking my password here dangerous?

Not here — nothing leaves the tab. What IS dangerous is typing your password into "strength checkers" that don't tell you where the math runs. If a checker doesn't loudly claim client-side, assume the worst.