How password strength is measured
The checker analyses passwords across several dimensions simultaneously: length, character diversity, entropy (bits of randomness), pattern detection, and comparison against common password lists. No single metric tells the whole story — a 20-character password made of only one repeated character is both long and weak. The combined score reflects all these factors.
Entropy: the core metric
Entropy is calculated from two factors: the password length and the size of the character set used. A password that only uses lowercase letters has a character space of 26. One that uses lowercase, uppercase, digits, and symbols has a space of about 90. The formula is: entropy = length × log₂(charset_size). A 12-character password using all character types has approximately 12 × log₂(90) ≈ 76 bits of entropy.
Each bit of entropy doubles the number of guesses required. 76 bits means 2^76 ≈ 75 septillion possible passwords. At 10 billion guesses per second — the speed of a modern GPU cracking rig — that is about 240,000 years to guarantee cracking. The crack time estimate in the tool uses this 10 billion guesses/second baseline for offline attacks, which is the relevant scenario for a database breach.
Common password detection
The checker compares your password against a list of the most commonly used passwords — "password", "123456", "qwerty", "letmein", "iloveyou", and hundreds more. These appear in every attacker's first-pass dictionary. If your password matches one, the strength score drops to near zero regardless of its technical entropy, because it will be cracked in the first few thousand guesses of any serious attack.
Pattern detection
The checker identifies patterns that dramatically reduce effective entropy: all-same-character passwords (aaaaaaaa), keyboard walks (qwerty, asdfgh, 12345678), and simple sequences. These patterns are well-known to attackers and are among the first things checked in a dictionary attack, making the effective security far lower than the raw character count suggests.
Character composition analysis
The composition bar shows how many of each character type your password contains. A well-balanced password has a reasonable mix across all enabled types. A password with 14 lowercase letters and 1 number has a very lopsided composition — the number adds very little entropy while creating a false sense of meeting "complexity requirements". Better to have 3–4 of each type evenly distributed.
Offline vs online attacks
The crack time estimates assume an offline attack — an attacker who has obtained your hashed password from a breach and is cracking it on their own hardware with no rate limiting. Online attacks (guessing your password at a login form) are constrained by account lockouts and rate limiting, making even weaker passwords practically secure against them. The offline scenario is the relevant threat model when a service you use is breached.