The vulnerabilities described here align with the OWASP Top 10, the industry-standard list of the most critical web security risks, and MITRE CWE Top 25. Severity uses CVSS v3 scoring from NIST's National Vulnerability Database.
Type a password to see its strength, entropy, and estimated time to crack. This runs entirely in your browser — nothing is sent anywhere.
If your API keys are in the bundle or your database has no row-level security, the password doesn't matter. Get your full Launch Readiness Score in ~60 seconds.
Get my free scorePassword strength is calculated from two core properties: entropy and pattern avoidance. Entropy measures the number of possible combinations — a 12-character random password mixing uppercase, lowercase, digits, and symbols has roughly 79 bits of entropy, which makes brute-force cracking impractical even with modern GPU clusters. Pattern avoidance means steering clear of dictionary words, keyboard walks (qwerty, 123456), and predictable substitutions (p@ssw0rd).
This checker uses the zxcvbn algorithm, the same approach used by Dropbox and many major authentication providers. It checks your input against a 30,000-word dictionary, keyboard patterns, common names, and year patterns, then returns a realistic time-to-crack estimate under a fast offline attack scenario.
Password strength is one layer of a defense-in-depth strategy. Even an unguessable password can be bypassed if your app has a brute-force vulnerability — no rate limiting on your login endpoint means an attacker can try millions of passwords per hour. OWASP A07:2021 (Identification and Authentication Failures) lists missing account lockout as a critical failure mode, regardless of password complexity requirements.
Common authentication failures in AI-built apps include storing passwords in plaintext or with a fast hashing algorithm (MD5, SHA-1 instead of bcrypt or Argon2), accepting weak passwords without enforcement at the server side, and missing multi-factor authentication on admin and privileged routes.
NIST SP 800-63B (the current US government standard) recommends requiring a minimum of 8 characters, checking against a breach database at registration, and avoiding arbitrary complexity rules that frustrate users. The most important control is checking submitted passwords against known-breached lists — a 16-character random string provides far more protection than a forced-rotation policy every 90 days.
For vibe-coded apps using Supabase, Lovable, or Bolt.new authentication, verify that bcrypt cost factor is set to at least 10, password reset tokens expire within 15 minutes, and brute-force protection is applied at the API level — not just the frontend.