Free tool
Password and PIN strength checker
Type a password, passcode or PIN to see how many guesses an attacker needs and how long that takes, online with a rate limit, offline against fast and slow hashes, and on a phone with an attempt limit. The checker names the weak parts: common passwords, names, dates, keyboard runs, repeats and letter swaps. For PINs, it shows the rank in published PIN data.
Runs on this device. What you type is not sent or saved.
Make a passphrase
How it works
A password is as strong as the number of guesses an attacker needs before reaching it. Attackers do not try every combination in order. They start with leaked passwords, words, names, dates and keyboard runs, then mix them. The checker counts guesses the same way.
- Find the parts. zxcvbn splits what you type into known pieces: a password from leak lists, an English word, a first or last name, a date or a year, a run of neighboring keys, a repeat, a sequence, or a word with letter swaps such as @ for a. Anything else counts as random characters.
- Count the guesses. Each part gets a guess count from its place in its list. The checker multiplies them and takes the cheapest way to build the whole input. For PINs, it also looks up the place of the PIN in published PIN data and keeps the lower count.
- Turn guesses into time. The same count takes very different times, depending on where the attacker guesses. The table shows 5 cases.
| Attack | Speed | When it happens |
|---|---|---|
| On a phone with York Vault's wait | 5 tries, then up to 1 hour each | A person has your phone and types codes |
| Online, with a rate limit | 100 an hour | A website that slows down or blocks repeated logins |
| Online, no rate limit | 10 a second | A website with no protection against repeated logins |
| Offline, slow hash | 10,000 a second | A leaked database that stores Argon2id, scrypt or bcrypt hashes |
| Offline, fast hash | 10 billion a second | A leaked database that stores MD5, SHA-1 or NTLM hashes, cracked on graphics cards |
How the PIN check works
For a PIN of 4 or 6 digits, the checker looks it up in the lists that Markert and colleagues published with their 2020 study. The guess order for 4 digits comes from 204,432 PINs set on an iPhone lock screen app. The order for 6 digits comes from 2,758,490 six-digit numbers in the RockYou password leak. The checker also says if the PIN is on the list that the iPhone warned about in iOS 10.3: 274 four-digit and 2,910 six-digit PINs. Dates, years, repeats, mirrors and keypad lines get their own flags.
The study found that on a phone, the attempt limit matters more than the length. With 10 guesses, an attacker found 4.6% of 4-digit and 6.5% of 6-digit PINs. Pick a PIN with no date or shape in it, and use 6 digits or more.
Why the offline rows do not apply to York Vault
York Vault does not store your code. It turns the code into a key with Argon2id at 64 MiB of memory and 3 passes, then adds a step in the phone's Secure Enclave or Android Keystore. The key for that step never leaves the chip. So a copy of your library on a computer gives no way to test a guess, and every guess has to go through the wait on your phone. The offline rows show what happens to the same password on a website that leaks its database. For files you send, use a long passphrase, and see the file encryption tool.
Questions people ask
Is it safe to type my real password here?
The check runs in this browser. The page loads the checker code from yorkvault.com once, and no request after that carries what you type. Nothing goes into cookies or browser storage. To test it, load the page, turn off Wi-Fi, and type. It still works. You can also type a password that follows the same pattern as yours.
How long does it take to crack an 8-character password?
It depends on how the site stores it and how you chose it. A truly random 8-character password from the 95 keyboard characters has 6.6 × 10^15 options. Against a fast hash such as MD5 at 10 billion guesses a second, that takes about 8 days. Against a slow hash at 10,000 a second, about 21,000 years. A word plus a year falls in seconds either way.
Is a 6-digit PIN safer than a 4-digit PIN?
Against a person with your phone, not by much. In a 2020 study of 1,220 smartphone PINs, 10 guesses found 4.6% of 4-digit PINs and 6.5% of 6-digit PINs, and 100 guesses found 16.2% and 13.3%. People pick easier 6-digit PINs, such as 123456. Against offline guessing, 6 digits give 1,000,000 options instead of 10,000.
What are the most common PINs?
In the DataGenetics study of 3.4 million 4-digit passwords, 1234 was 10.7% of all of them, 1111 was 6.0% and 0000 was 1.9%. The 20 most common PINs covered 26.83%. For 6 digits, 123456 is 21 times more common than the next PIN in the RockYou leak. Years, birthdays and keypad lines such as 2580 follow.
How does an attempt limit change the strength of a PIN?
It turns millions of guesses a second into a few a day. York Vault allows 5 tries, then waits 30 seconds, 1 minute, 5, 15 and 60 minutes, then 1 hour before each try. 10 tries take about 1 hour 21 minutes, and after that about 24 tries fit in a day. A copy of the files on a computer cannot test a code at all.
What makes a passphrase strong?
Random choice, not clever words. The EFF dice list has 7,776 words, so 6 words picked at random give 2.2 × 10^23 options, about 77 bits. A phrase you make up, such as a song line or a saying, is in guess lists. Use dice or the passphrase maker on this page, and do not change the words afterward.
Sources
- zxcvbn: Low-Budget Password Strength Estimation (Wheeler, USENIX Security 2016) · checked Oct 8, 2026
- This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs (Markert, Bailey, Golla, Dürmuth and Aviv, IEEE S&P 2020) · checked Oct 8, 2026
- PIN lists and datasets of the study above · checked Oct 8, 2026
- PIN analysis (DataGenetics, 2012) · checked Oct 8, 2026
- EFF dice-generated passphrases (Electronic Frontier Foundation) · checked Oct 8, 2026
- RFC 9106: Argon2 memory-hard function for password hashing · checked Oct 8, 2026
Open source code in this tool
- zxcvbn-ts 4.2, MIT. The estimator and its English word lists. Based on zxcvbn by Dropbox
- fastest-levenshtein, MIT
- EFF large word list, CC BY 4.0, Electronic Frontier Foundation. The 7,776 words of the passphrase maker
- PIN lists from This PIN Can Be Easily Guessed, published by the authors for research. The iOS warning lists and the 4-digit and 6-digit guessing orders
York Vault
A code that only your phone can test
York Vault opens with a pattern, PIN or passcode that you pick. It flags common PINs while you set one, and shows the time to guess a passcode. Every guess has to run on your phone, with a wait after 5 wrong codes.
How York Vault's lock options workAll featuresMore free tools