Strength is about guessing, not secrecy
A password’s job is to be hard to guess. Everything about “strength” comes down to one question: how many guesses would an attacker need before they stumble onto yours? The bigger that number, the stronger the password. This is why the Password Strength Checker reports an estimated crack time rather than a vague “good/bad” — it is trying to put a number on how long guessing would take.
Entropy: the size of the haystack
The technical measure of guessing difficulty is entropy, expressed in bits. Entropy depends on two things: the length of the password and the size of the character pool it draws from.
The character pool is the set of symbols you could have used. Lowercase letters alone give a pool of 26. Add uppercase and it’s 52. Add digits and it’s 62. Add common symbols and it’s around 95. Entropy is then length × log2(poolSize) bits. So an 8-character lowercase password has about 8 × log2(26) ≈ 37.6 bits, while a 16-character password using all four classes has roughly 16 × log2(95) ≈ 105 bits. Every bit of entropy doubles the number of guesses required — so the jump from 37 to 105 bits is astronomically large. The Password Strength Checker shows this bit count directly so you can watch it climb as you type.
Why length beats complexity
Here is the counter-intuitive part most people get wrong. Swapping one letter for a symbol nudges the pool size up a little. But adding one more character multiplies the entire keyspace by the pool size again. Length is a lever; complexity is a nudge.
That’s the logic behind passphrases — four or five random words strung together. “correct-horse-battery-staple” is long, easy to remember, and has more entropy than a short cryptic string like “P@5w!”. The famous comic that popularised this idea was right: human-memorable length usually wins. Try both kinds in the Password Strength Checker and watch the crack time — the passphrase almost always comes out ahead. If you’d rather not invent one, the Password Generator builds a strong random password for you.
How crack time is estimated
To turn entropy into a human number, you assume an attacker’s guessing speed. A modern offline attack against stolen password hashes can manage billions of guesses per second — our tool assumes about ten billion. You then divide the total number of possible combinations (roughly half, on average, since the real password is somewhere in the middle of the keyspace) by that rate. The result is the crack-time estimate.
This is deliberately a fast offline assumption, which is the pessimistic case. Online attacks against a live login form are far slower because of rate limits and lockouts. The point of using the fast number is to give you a safety margin: if a password resists the worst case, it’s comfortably fine for the everyday case. The mechanics of these attacks are covered in our brute-force attack explainer.
What the score can’t see
A strength meter only sees the password’s structure. It cannot know two things that matter enormously in the real world.
First, reuse. If you use the same strong password on ten sites and one of them is breached, all ten are compromised — and no strength score would have warned you. Unique passwords per site are non-negotiable, which is exactly the problem password managers solve.
Second, breaches. A password can be structurally strong and yet already sitting in a public breach dump because someone else chose it too. That’s why our checker hard-caps obvious common passwords to “very weak” regardless of their shape — but a private, leaked password it cannot detect offline. For broader habits beyond a single check, see how to create a strong password.
The habits that beat any score
A strong password is one layer of several. The combination that actually keeps accounts safe is simple: use a long, unique password for every site (a manager makes this painless), turn on two-factor authentication everywhere it’s offered, and never reshare a password across services. With those habits in place, the strength score becomes a useful tuning instrument rather than your only line of defence.
It’s also worth prioritising. Not every account carries the same risk, so spend your effort where it matters most. Your email account is the crown jewel, because password resets for everything else flow through it — give it your strongest password and the hardest second factor you can manage. Your bank, primary identity, and password manager come next. Throwaway logins for one-off sites matter less, though a manager makes it trivial to give even those a strong unique password, so there’s little reason not to. Running your most important logins through the Password Strength Checker one by one is a quick, concrete audit you can do in a few minutes.
Passphrases: the practical sweet spot
If you take one practical habit from all of this, make it the passphrase. Instead of a short, cryptic string you’ll forget and reuse, string together four or five unrelated words — ideally chosen at random rather than from a favourite song lyric. A phrase like “amber-trellis-volcano-ledger” is long enough to reach high entropy, contains natural word boundaries that make it typeable, and is genuinely memorable in a way that “X9#qL2!” never will be. The Password Strength Checker makes the case vivid: enter a passphrase and a short complex password side by side and the passphrase almost always shows a longer crack time.
The one caveat is that the words must be unpredictable. A phrase built from common quotes, names, or sequential words gives an attacker a much smaller search space than the raw entropy suggests, because cracking tools try likely word combinations first. Pick words with no connection to each other or to you, avoid substitutions everyone uses (“p@ss”), and never reuse even a great passphrase across sites. If inventing random words feels hard, let the Password Generator do it, then verify the result here.
The takeaway
Password strength is really about entropy — length multiplied by the variety of characters — and length is the most powerful lever you have. The Password Strength Checker makes this tangible by showing the entropy in bits, an estimated crack time, and exactly which criteria you’re missing. Use it to tune a password, lean toward memorable length over cryptic complexity, and remember that uniqueness and two-factor authentication matter just as much as the score on screen.