Password Strength Checker

Eighty-four out of a hundred, and why length beats symbols

The password Tr0ub4dor&3 scores 84 — rated Strong, at 11 characters using 4 character types.

That password is also the subject of one of the most-cited observations in security: it is considerably weaker than a passphrase like "correct horse battery staple", despite looking far more complex. Understanding why changes how you choose passwords.

What actually determines strength

Password strength is measured in entropy — the number of guesses required, expressed in bits. Each additional bit doubles the work for an attacker.

Entropy ≈ length × log₂(character set size)

The character set matters, but it sits inside a logarithm, while length multiplies. That asymmetry is decisive:

• 8 characters, full mixed set (~95 possible) ≈ 52 bits
• 12 characters, lowercase only (26 possible) ≈ 56 bits
• 16 characters, lowercase only ≈ 75 bits

A sixteen-character all-lowercase passphrase is far stronger than an eight-character password using every symbol on the keyboard — and much easier to remember and type.

This is why modern guidance, including NIST SP 800-63B, recommends prioritising length, allowing all characters including spaces, permitting very long passwords, and abandoning mandatory complexity rules and periodic expiry, both of which were found to push users towards predictable patterns.

Why a substitution-based password scores worse than it looks

"Tr0ub4dor&3" applies transformations that humans find memorable and attackers find trivial: a capitalised first letter, o→0, a→4, and a symbol and digit at the end.

Password-cracking tools apply exactly these rules by default. A dictionary word with common substitutions is barely stronger than the dictionary word itself, because the attacker's wordlist is expanded by rule rather than by brute force.

The strength score here reflects length and character variety, which is what any simple checker can measure. It cannot assess whether your password is a dictionary word, appears in a breach corpus, or follows a predictable pattern — and those factors dominate real-world crackability.

What actually keeps accounts safe

A password manager. Long random unique passwords for every site, with only one to remember. This single change eliminates reuse, which is the mechanism behind most account takeovers.

Passphrases where you must remember something — four or five random words, chosen by dice or software rather than by you, since human-chosen words are not random.

Two-factor authentication, which protects you even when a password is compromised. An authenticator app or hardware key is materially stronger than SMS, which is vulnerable to SIM swapping.

Never reusing a password. Credential-stuffing attacks take passwords breached from one site and try them everywhere else, and they succeed constantly.

Checking for breaches — services exist that let you test whether a password appears in known breach corpora without transmitting it.

Reading the score

Treat this as a rough indicator of length and character variety, not a verdict on safety. A password can score highly here and still be weak if it is a common phrase, appears in a breach list, or is reused from another site.

Note also that nothing you type here leaves your browser — the calculation runs locally. As a general habit, though, never enter a password you actually use into any online checker.

Common mistakes

Prioritising symbols over length. Length contributes far more entropy.

Using character substitutions. Cracking tools apply them automatically.

Reusing passwords across sites. The single largest practical risk.

Relying on periodic forced changes. Current guidance advises against them; they encourage predictable increments.

Treating a strength meter as a guarantee. It cannot see reuse, breaches or patterns.