The leet-speak substitution myth
Replacing letters with similar-looking numbers or symbols — p@ssw0rd, 53cur1ty, @dm1n — was once considered a smart technique. Attackers figured this out decades ago and include all common substitutions in their dictionaries. The checker will flag "p@ssw0rd" as extremely weak despite containing a symbol and a number, because the substitution pattern is trivially predictable. Substitutions do not meaningfully increase security.
Why "Summer2024!" fails despite seeming complex
Passwords based on a word plus a year plus punctuation — Summer2024!, Winter2023#, January!2024 — follow predictable structures that attackers enumerate specifically. The checker detects this pattern and scores it appropriately. The season + year + symbol formula is so common that it appears in most modern cracking dictionaries. A random 12-character password from a generator is dramatically stronger than any human-invented formula.
Length wins over complexity at the same character count
Compare "Tr0ub4d0r" (9 characters, mixed) with "correcthorse" (12 characters, lowercase only). The 12-character lowercase password has more entropy than the 9-character "complex" one — despite using only 26 possible characters vs the mixed character space — because length compounds multiplicatively. Every additional character multiplies the total possibilities by the charset size.
Use the checker to audit your existing passwords
If you have been using passwords you invented yourself, check them here. Most people are surprised to find that passwords they thought were strong — "MyDog$Biscuit2019", "P@ssw0rd123" — score very poorly due to predictable structures. The analysis section explains exactly why each password fails and what to change.
The crack time assumes the worst case
The 10 billion guesses/second assumption reflects a well-funded attacker with modern GPU hardware running an offline attack against a poorly hashed database. Real-world attacks vary enormously. Passwords protected by bcrypt or Argon2 (slow hashing algorithms) are orders of magnitude harder to crack even at the same entropy — the hashing algorithm matters as much as the password itself.