scan.now
Premium Scan a site

Password is weak

The password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words with predictable changes.

Do this: Replace it with four random words, or 20 generated characters. It falls within the first few seconds of an offline attack against a leaked password database.
PassThe password resists guessing at realistic attacker speeds.
HighThe password can be guessed quickly.

The fix, in one snippet

Example to adapt What actually helps 
correct-horse-battery-staple   <- four random words, easy to type
P@ssw0rd1!                     <- the shape every cracker tries first

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

A zxcvbn-style estimator runs in your browser. It matches the password against dictionaries (common passwords, English words, first and last names, popular culture), l33t substitutions, keyboard walks (qwerty, 1qaz2wsx), repeats, sequences (abcd, 6789) and dates, finds the cheapest combination of matches that covers the whole string, and converts the resulting guess count into estimated crack times for four attacker models: online throttled, online unthrottled, offline against a slow hash such as bcrypt, and offline against a fast hash. Scores run 0 to 4 and the check fails below 3. Length under twelve characters is flagged separately, as is a password that satisfies "complexity" rules while scoring badly, such as P@ssw0rd!. Limits: it is an estimator. It cannot know a site's hashing scheme or whether your dog's name is in a list targeted at you, its dictionaries are English-centric, and it cannot judge how randomly you chose the words of a passphrase.

Why it matters

When a site is breached, its password hashes are cracked offline. Against fast hashes (MD5, SHA-1, NTLM) a GPU rig tries billions of guesses per second, so anything under roughly 1012 guesses falls in hours, and rule sets cover the human patterns the estimator models. Composition rules produce predictable structure: a capital first, a digit and a symbol at the end. An eight-character password that passes every complexity rule is trivial to crack once its hash leaks, and everyone with such a password on a site that stores fast hashes is affected.

How to fix it

Length beats complexity. Use a password manager to generate fourteen or more random characters per site, or a passphrase of four or more randomly chosen words for the few you must memorise. Never derive a password from the site name or from another password.

weak:   Summer2026!            (dictionary word + year + symbol)
better: correct-horse-battery-staple-quartz   (random words, generated)
best:   Xq7#mVt2$pL9wR4n       (manager-generated, unique per site)

Enable two-factor authentication. Site operators: follow NIST SP 800-63B, which says allow at least 64 characters, drop composition rules and forced rotation, and screen against breach lists. Related: predictable patterns and breached passwords. Guides: password security, browser password managers and two-factor authentication.

Where this fits

Password is weak is check 2 of 3 that the password strength & breach checker runs under password security, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Password found in a known data breach (critical), where this exact password appears in Have I Been Pwned's Pwned Passwords corpus of real breach data, so attackers already have it in their lists. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Password is weak closes one route in. The next one down is Password follows a predictable pattern, where the password follows a structure people use constantly, such as a word plus a year, a capital first letter with a symbol at the end, or a keyboard walk, which cracking rules try first.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Password is weak (high severity)
Scanner check id: password-weak
18 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. Wheeler, zxcvbn: Low-Budget Password Strength Estimation (USENIX Security 2016)
  2. Dropbox zxcvbn (GitHub)
  3. NIST SP 800-63B: Authentication and Authenticator Management
  4. NCSC: The logic behind three random words

Related guides

8 min read · Updated Sep 11, 2026 Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked

Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...

Read the guide 6 min read · Updated Sep 17, 2026 Are Browser Password Managers Safe? Built-In vs Dedicated Managers

Chrome, Firefox, Safari and Edge all store passwords, and they are safer than reuse. This guide compares built-in managers with...

Read the guide 8 min read · Updated Sep 12, 2026 Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys

A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...

Read the guide