>_ Tools / Password Strength Checker
Password Strength Checker
Type a password to see how long it would take to crack, which weak patterns it has, and whether it appeared in a data breach. Then generate a stronger one.
FreeNo sign-up
Your password never leaves your device. The breach check only sends the first 5 characters of its SHA-1 hash to Have I Been Pwned.
Generate a secure password
>_ What it checks
>_ Guide
What makes a password strong?
Length matters most. Every extra character multiplies the number of guesses an attacker needs. An 8-character password with odd symbols like P@ssw0rd! falls faster than a four-word passphrase like durian-Rainbow-bicycle-river-42, because attackers already know people swap a for @ and s for $.
This tool estimates entropy (in bits) from length and character types, then deducts points for patterns found in cracking dictionaries: popular words, MyKad numbers, birth dates, phone numbers and keyboard runs like qwerty.
Weak patterns common in Malaysia
| Pattern | Example | Why it is weak |
|---|---|---|
| "sayang" plus numbers | sayang123 | One of the most common passwords in local breach data. |
| MyKad number | 900101-14-5678 | IC numbers leak through forms, photocopies and data breaches. |
| State or country name | Malaysia2026 | Attackers add local words to their dictionaries. |
| Birth date | 01011990 | Easy to find on social media. |
| Phone number | 0123456789 | Known to anyone who has your number. |
How the breach check works
The breach button uses the k-anonymity method of the Pwned Passwords service by Have I Been Pwned. Your browser hashes the password with SHA-1 and sends only the first 5 characters of the hash. The service returns hundreds of hashes that start the same way, and your browser does the matching itself. Your password, and even its full hash, are never sent.
Safe password habits
- One password per account, so a breach on one site cannot unlock another.
- Use a password manager so you only need to remember one strong passphrase.
- Turn on two-step verification, ideally an authenticator app or passkey rather than SMS alone.
- Never share OTP or TAC codes with anyone, including people claiming to be from a bank or the police.
>_ FAQ
Frequently asked questions
Is it safe to type my real password here?
The strength calculation happens entirely in your browser and nothing is sent. The breach check sends only the first 5 characters of a SHA-1 hash. If you are still unsure, test a password with a similar pattern instead.
How long should a password be?
At least 12 characters, and 14 or more for important accounts like email and banking. A passphrase of 4 to 5 random words is strong and easier to remember.
What is a passphrase?
A passphrase is several random words joined together, for example coffee-Elephant-beach-kite-27. It is long, so hard to guess, but easier to remember than random characters.
My password was found in a breach. What now?
Change it on every account that uses it, starting with email and banking. Turn on two-step verification and review recent sign-in activity.
How is the time-to-crack estimate calculated?
We assume an attacker has a copy of the password hash and tries 10 billion guesses per second, which is an offline attack with modern GPUs. Well-protected sites are far slower to attack, but database leaks happen often.
>_ Mission control
Is your company password policy strong enough?
RC.MY audits Active Directory, Microsoft 365 and internal systems for weak passwords and risky access.
>_ Tools
More free tools
Every tool is free, needs no sign-up, and is built by the RC.MY penetration testing team.
Also on RC.MY Surah Al-Mulk · Surah Yasin · Surah Al-Waqiah · Surah Al-Fatihah · Surah Al-Kahf · Surah Ar-Rahman · Ayat Kursi · Ayat 1000 Dinar · Doa harian