Password Strength Checker

Strength here is estimated as entropy: how large a space an attacker would have to search, expressed in bits. Each additional bit doubles that space. The estimate accounts for length, the variety of character classes present, and detectable patterns: dictionary words, keyboard runs, repeated characters, dates, and the common substitutions that replace letters with lookalike symbols. A password that scores poorly despite containing every character class is usually one where those patterns collapse most of the apparent search space.

This is why the result often disagrees with the meter on a signup form. Most of those meters score composition rules: one uppercase, one digit, one symbol, minimum eight characters, green tick. "P@ssw0rd1" satisfies every one of them and is among the first few thousand candidates any cracking tool tries. Meanwhile a long string of ordinary lowercase words fails every rule and would take an infeasible amount of computation to guess. The rules were written to stop people choosing "password", and they succeeded at exactly that and nothing more.

An entropy figure is still an upper bound on difficulty, not a guarantee. It assumes the attacker has no information you have not accounted for, and it cannot know that your strong, unique password was reused on a site that was breached last year, at which point its entropy is irrelevant, because it is on a list. The practical implications are that reuse defeats any amount of strength, that a password manager solves the reuse problem, and that multi-factor authentication protects the accounts where all of this fails anyway. Nothing you type here is transmitted; the analysis runs in this tab.