What "strong" actually means ?
Password strength isn't just about length or throwing in a special character — it's about how long it would take an attacker to guess or brute-force it, given modern cracking hardware. A 16-character passphrase made of ordinary words ("correct horse battery staple") is often *more* resistant to cracking than an 8-character password with symbols, because the search space (the number of possible combinations) is what matters, not the presence of a "@" symbol.
What this tool actually checks
Length — the single biggest factor in resistance to brute-force attacks.
Character variety — uppercase, lowercase, numbers, symbols, and whether they're distributed through the password or just tacked on at the end (e.g., "Password1!" is weak precisely because the variety is predictable).
Common patterns — sequences like "1234", keyboard walks like "qwerty", and dictionary words, which crackers check first.
Estimated crack time — a rough, easy-to-understand estimate of how long the password would hold up against automated guessing.
How to build a genuinely strong password
1. Aim for
at least 12–16 characters.
2. Use a
passphrase of unrelated words rather than a single word with substitutions (swapping "a" for "@" is well known to attackers and barely helps).
3.
Never reuse passwords across sites — a password strength score doesn't protect you if the same password leaks from an unrelated breach.
4. Consider a
password manager to generate and store unique passwords per site, so you don't need to remember dozens of strong ones.
Privacy note
Your password is analyzed entirely in your browser using local pattern-matching — it is never transmitted, logged, or stored anywhere, which is important, since typing a real password into any online "checker" should always come with that guarantee.
FAQ
Is it safe to type my real password into this tool?
The check runs client-side only, so nothing leaves your browser. That said, as a general habit, testing a
similar password (same length/pattern, different characters) is a good practice for any online tool.
Why did a long password still score as weak?
If it's a common phrase, name, or contains obvious sequences, length alone won't save it — attackers' dictionaries include long common phrases too.