About this tool
Is My Password Quantum Proof? is a free, browser-based password checker built by MICKAEL GOMES CONSULTING. It scores how hard a password is to guess, estimates how long a conventional computer and a future quantum computer would need to crack it, and flags passwords that already appear in known data breaches — all without your password ever leaving the page.
Who builds it
The project is developed and maintained by MICKAEL GOMES CONSULTING, an independent team that ships small, privacy-respecting web utilities. We built this checker because the public conversation about "quantum-proof" passwords is full of hand-waving and fear, and we wanted a transparent calculator that shows its working rather than a marketing number. Nothing here is sold, and there is no account to create.
How strength is measured
We score passwords with zxcvbn, an open-source estimator that models the patterns attackers actually exploit — dictionary words, keyboard walks, common substitutions, dates, repeats and sequences — instead of naively counting character classes. zxcvbn returns a guesses value: roughly the number of attempts an attacker would make before reaching your password. That single number drives both of the crack-time estimates below.
Conventional crack time
For a classical attacker we assume a sustained offline rate of about one billion (1×109) guesses per second — a reasonable figure for a well-resourced attacker running a fast hash on commodity GPUs. We divide zxcvbn's guess count by that rate to estimate the time to exhaust the search. This is an approximation, not a guarantee: a slower hash buys you more time, and a faster cluster buys the attacker more.
Quantum crack time
For the quantum estimate we apply Grover's algorithm, which gives a quadratic speedup on unstructured search. Instead of needing work proportional to the full guess count, a quantum attacker needs work proportional to its square root (√guesses). We model quantum operations conservatively at about one million (1×106) per second, reflecting how much slower today's quantum hardware is per operation. Halving the effective bit-strength is exactly why quantum computing is a real concern — and why length matters more than ever.
The strong-password checklist
Alongside the math, we check five practical traits and mark a password "strong" only when it satisfies all of them:
- contains a lowercase letter
- contains an uppercase letter
- contains a number
- contains a symbol
- is at least 16 characters long
Length is the single biggest lever against both classical and quantum attacks, which is why our threshold is 16 characters rather than the customary 8.
Why trust the numbers
Every estimate is computed locally in your browser from public, well-documented models. We deliberately err toward conservative attacker assumptions so the tool is a useful early warning rather than false comfort. Treat the results as a guide for choosing better passwords and a password manager — not as a precise security certificate.