How Password Strength is Measured — Entropy, Crack Time, and Common Pitfalls
A password strength checker does more than count character types. It estimates how many guesses an attacker would need — and how long that would take on modern hardware. This tool evaluates your password against entropy calculations, a database of common passwords, keyboard pattern detection, and dictionary matching. Everything runs locally in your browser; your password is never transmitted anywhere.
Where N is the character set size (e.g., 95 for full printable ASCII) and L is the password length. A password with >72 bits of entropy is considered strong against an offline GPU attack at 10 billion guesses per second.
Why Length Beats Complexity
Adding one character to a password drawn from a 95-character set (lowercase, uppercase, digits, symbols) adds 6.57 bits of entropy — multiplying the search space by 95. Switching from lowercase-only to full ASCII on a 10-character password adds only about 20 bits total. The math is clear: going from 10 to 16 characters adds more security than any character-type rule. A 16-character lowercase-only random string (26^16 ≈ 2^75 possibilities) is stronger than an 8-character complex password (95^8 ≈ 2^52 possibilities).
Pattern Detection: The Hidden Weakness
Password crackers do not only try every combination blindly — they use rule-based attacks that model how humans construct passwords. Common rules tested: append a digit (password1), capitalize the first letter (Password), leet-substitute (p4ssw0rd), add a year (password2024), append symbols at the end (password!). The zxcvbn algorithm (used by Dropbox and others) models exactly these patterns. A password that looks complex but follows a predictable rule may have an effective entropy of just 20–30 bits regardless of its character variety.
What Crack Time Estimates Actually Mean
Crack time estimates assume an attacker has obtained a password hash offline — from a data breach — and is attacking it with a GPU cluster. At 10 billion guesses/second (MD5 benchmark for a consumer GPU), a 40-bit entropy password falls in seconds. A 60-bit password takes about 33 years. A 72-bit password exceeds the age of the universe. However, these estimates only hold if the password is truly random — one following a known pattern has far fewer effective combinations than its character count implies.
Practical Password Security
The realistic path to secure passwords is a password manager that generates and stores 20+ character random strings unique to each site. This makes brute-force irrelevant (the password is unguessable), eliminates reuse (a breach on site A does not affect site B), and removes the memory burden. For passwords you must type manually — device lock screens, password manager master password — use a 5- or 6-word Diceware passphrase: memorable, long, and with provably high entropy.
Frequently Asked Questions
What makes a password strong?
Strength comes from length and unpredictability. A longer password from a large character set has more possible combinations. But unpredictability matters equally — 'Password1!' is 10 characters with uppercase, digits, and symbols, yet it is trivially cracked because it matches a known pattern. Strong passwords are long, random, and contain no words, names, dates, or keyboard walks like 'qwerty'.
What is password entropy?
Entropy measures how unpredictable a password is, expressed in bits. It is calculated as log₂(N^L), where N is the size of the character set used and L is the password length. A password with 72+ bits of entropy is considered strong against offline GPU brute-force attacks. Adding one character to a password drawn from a 95-character set adds about 6.5 bits of entropy.
How long should a password be?
NIST (SP 800-63B) recommends passwords of at least 8 characters, but security professionals broadly recommend 12–16 characters minimum for individual accounts. At 16 random characters from a full ASCII printable set, cracking time exceeds centuries even for well-resourced attackers. For high-value accounts (email, banking), use a randomly generated password of 20+ characters stored in a password manager.
Is a passphrase more secure than a complex password?
Often yes. 'correct-horse-battery-staple' (four random words) has roughly 44 bits of entropy and is trivially memorable, while 'Tr0ub4dor&3' has only about 28 bits despite looking complex because it follows predictable substitution patterns that attackers model. A five-word Diceware passphrase achieves 64 bits of entropy — exceeding most complex passwords while being far easier to type and remember.
What is a brute-force attack?
A brute-force attack systematically tries every possible combination of characters until the correct password is found. Modern GPUs can attempt billions of guesses per second against leaked password hashes. This checker estimates crack time assuming 10 billion guesses per second — a realistic offline GPU attack rate for MD5-hashed passwords. Bcrypt or Argon2 hashing would slow this by orders of magnitude.
Does my password get sent anywhere when I check it here?
No. All analysis — entropy calculation, pattern matching, dictionary checks — runs entirely in your browser using JavaScript. Your password never leaves your device. There are no server requests made when you type.
Why does the checker warn about keyboard patterns?
Sequences like 'qwerty', '123456', 'zxcvbn', and 'asdfgh' are among the first things password crackers test after common word lists. Even embedded in a longer password ('mypassqwerty2024'), they significantly reduce the effective search space because attackers model these patterns explicitly in their attack dictionaries.
What is credential stuffing and why does it matter?
Credential stuffing is an attack where passwords leaked from one breach are automatically tried against other services. If you reuse a password, a breach on one site immediately compromises every site where you use the same credentials. A strong, unique password per site is the single most impactful security practice — use a password manager to make this feasible.