Password Strength Checker

A password's strength does not depend on whether it looks complicated to you but on how many attempts an attacker needs to guess it. The measure is entropy, in bits, describing the size of the search space. Twelve characters chosen at random from lowercase, uppercase, digits and symbols lands around 78 bits; a dictionary word with a number on the end lands around 20, however long it is.

The base calculation is simple: length times the base-two logarithm of the alphabet size. But that number is only real if the characters are genuinely random. People do not choose randomly: they put the capital at the start, the number at the end, swap a for @ and use dates and names. Cracking software knows all those patterns and tries them first, so this tool applies penalties for common words, keyboard sequences, repeats and anything resembling a year.

The practical conclusion of that arithmetic usually surprises people: length beats complexity almost every time. Adding a character multiplies the search space by the alphabet size, while adding a character type only widens it once. Four or five random words are stronger and far easier to remember than eight characters full of symbols, which is precisely the opposite of what password policies demanded for twenty years.

There is an important limit to any strength meter, this one included: it does not know whether your password already appears in a breach. A password with seventy bits of entropy that shows up in a public dump breaks on the first attempt, because the attacker is not guessing it but looking it up. That is why the real recommendation is a password manager generating a different random string per service, plus a second factor wherever possible. And do not type a password here that you actually use: the analysis is local, but the habit is bad.