Password strength checker

How it works

There is an obvious problem with password strength checkers: using one means typing a password into a website. Most do the check on a server, which means your password has been transmitted to a stranger. This one never leaves the page, which is the only arrangement that makes the exercise sensible at all.

What the estimate means

The character sets used and the length give an entropy figure in bits. That is converted to a cracking time assuming ten billion guesses a second — a realistic rate for an attacker with a modern graphics card working offline against a leaked password database. Online attacks against a live login are far slower, so this is the pessimistic case, which is the useful one.

Length beats complexity

Adding one character multiplies the work more than swapping a letter for a symbol. A long passphrase of ordinary words beats a short unpronounceable string on both strength and memorability, which is why modern guidance favours it.

The limit of any strength meter

This measures shape only. It cannot know that your password is in a breach list, that it is your dog's name, or that it is the most common password in the world — and any of those falls instantly regardless of what the meter says. Treat a good score as necessary rather than sufficient.

The genuinely good answer

A password manager generating a long random password per site removes the problem entirely, because you never have to remember or reuse one.