Weak Password Pattern Checker

Most password checkers return a coloured strength bar that moves from red to green without explaining why a password is weak. Weak Password Pattern Checker does the opposite: it runs 10 named structural tests derived from breach-analysis research and NIST SP 800-63B, and explains exactly which pattern each password triggers and why that pattern makes cracking easier. Everything runs locally — no password is transmitted anywhere.

Type or paste any password to see the full breakdown instantly. Load Sample cycles through known weak examples so you can see what a flagged result looks like before testing your own.

Worked Example: Why P@ssw0rd123 Fails Six Tests

The first Load Sample click inserts P@ssw0rd123, which fails 6 of the 10 checks. The common-word test flags it because the l33t-normalised form password123 contains the root password. The l33t-speak test fires separately because those substitutions are masking that same root. The year test is clean (no 19xx/20xx), but the digit and special-character checks both pass, which explains why this password fools simple bar-based meters: it has a digit and a symbol, but the underlying word is in every cracking dictionary under its l33t variant already. The verdict banner reads “6 weak patterns found” in red.

What Each Pattern Checks

• Minimum 8 characters: from NIST SP 800-63B §5.1.1, which sets 8 as the floor for memorised secrets and recommends allowing up to 64. Passwords under 8 characters fail this check.
• Under 128 characters: above 128 characters, some systems silently truncate or hash-flood. The check warns when a password exceeds that threshold.
• Not a common password word: the password (after l33t normalisation) is checked against roughly 200 high-frequency roots from the HaveIBeenPwned top-10 000 corpus. Matching any root triggers this flag.
• No keyboard walk: patterns like qwerty,asdfgh, zxcvbn, 1234 and their variants are cracked in under one second by any dictionary attack.
• No repeated characters: three or more identical characters in a row (e.g. aaa, 111) reduce effective entropy; the message names the specific repeating sequence.
• Not just l33t-speak substitution: fires when l33t substitutions are the only thing separating the password from a common root, since cracking tools normalise these automatically.
• No year pattern: a four-digit year (19xx or 20xx) anywhere in the password is one of the first patterns brute-force tools enumerate after dictionary words.
• Digit, special character, mixed case: the final three checks measure character-set diversity. All three failing on the same password doubles the cracking difficulty with each one added.

When Not to Use This as Your Only Check

A password that passes all 10 structural tests can still appear in a breach database if it has been used before and leaked. These checks catch structural weakness, not historical exposure. For breach lookup, use Have I Been Pwned’s password search, which uses k-anonymity so the full password never leaves your browser. For real account protection, a password manager generating a random 20-character string sidesteps every structural weakness this tool tests for.