Complete Guide to Password Strength Analysis
Password strength is not a simple binary of "strong" or "weak" — it exists on a spectrum determined by multiple factors: length, character diversity, randomness, and absence of predictable patterns. This guide explains exactly how our analyzer evaluates your password, what each metric means, and how attackers think when they try to crack it.
How Our Analyzer Works
When you type a password, the analyzer performs 12 distinct checks in real time, each contributing to an overall score out of 100:
Points for each character, with diminishing returns above 20
Length × log₂(pool size), measures theoretical unpredictability
Rewards using multiple character types (upper, lower, numbers, symbols)
Penalizes repetitive characters like "aaa" or "111"
Compares against 500 most common passwords from breach data
Detects "abc", "123", "qwerty", and reversed sequences
Finds "aaa", "111", "!!!", and other repeats
Detects "qwert", "asdf", "zxcv" and adjacent key patterns
Identifies "p@$$w0rd", "4dm1n" and similar substitutions
Finds embedded dates like "2024", "0101", "1990"
Checks for "password", "admin", "welcome", etc. within the password
Calculates time for 4 different attack scenarios
Understanding the Score (0–100)
| Score Range | Rating |
|---|---|
| 0 – 19 | Critical |
| 20 – 39 | Weak |
| 40 – 59 | Moderate |
| 60 – 79 | Strong |
| 80 – 100 | Excellent |
Why Length Beats Complexity
A persistent myth is that adding symbols and numbers makes a password much stronger. The math tells a different story. Consider these two passwords:
"Tr0ub4d&3" — 8 chars, 4 types → ~52 bits entropy → crackable in 5 hours on a GPU
"correct-horse-battery-staple" — 28 chars, 1 type → ~124 bits entropy → crackable in 10¹⁸ years on a GPU
The second password has no symbols, no numbers, no uppercase — yet it's trillions of times harder to crack. This is because each additional character multiplies the search space by the pool size. Going from 8 to 16 characters multiplies by 95¹⁶ ≈ 4.4 × 10³¹ — an incomprehensibly large number. Adding one more character type to an 8-character password only multiplies by about 1.5×. Length is the single most important factor in password strength.
The Pattern Detection Problem
Entropy is a theoretical measure that assumes perfectly random character selection. In reality, humans don't pick characters randomly — they follow patterns. "P@ssw0rd!" has the same theoretical entropy as a truly random 9-character password with the same character pool, but any attacker will crack it in seconds because it's in every dictionary attack wordlist. Our analyzer detects these patterns and penalizes the score accordingly, giving you a more realistic assessment than pure entropy alone.
The patterns we detect include: common passwords (top 500), sequential characters (abc, 123, cba, 321), keyboard walks (qwert, asdf, zxcv), repeated characters (aaa, 111, !!!), leet speak substitutions (@ for a, 0 for o, 3 for e, $ for s), embedded dates (2024, 0101, 1225), and common words (password, admin, welcome, login, master, dragon, monkey, etc.). Each detected pattern reduces the score and generates a specific warning with explanation.
How Crack Time Is Calculated
We estimate crack time for four attack scenarios, each with different assumptions:
| Attack Type | Speed |
|---|---|
| Online brute force | 1,000/sec |
| Offline fast hash | 1 billion/sec |
| Offline GPU cluster | 100 billion/sec |
| Dictionary + rules | 1 billion/sec |
The formula is: Time = Pool^Length / (2 × Speed) (dividing by 2 because on average the password is found halfway through the search space). For dictionary attacks, we assume a 10-billion-entry wordlist with 100× rule expansion, giving 1 trillion candidates. If your password appears in the list, it's found almost instantly; if not, the attack fails.
What This Checker Does NOT Do
Transparency is important. Here's what our checker deliberately does not do:
- Does not check against Have I Been Pwned's full database — that requires sending your password (or its hash) to a server, which violates our zero-transmission principle. For comprehensive breach checking, use haveibeenpwned.com/Password directly.
- Does not check against leaked credential pairs — knowing a password was in a breach is useful, but checking requires server communication.
- Does not simulate advanced rule-based attacks — tools like Hashcat can apply thousands of transformation rules. We detect common leet-speak patterns but can't simulate the full rule engine.
- Does not account for context-specific weakness — "SmartToolGalaxy2024!" might score well here but would be trivially guessable for anyone who knows you use that site.
Password Policies: Helpful or Harmful?
Research consistently shows that strict composition rules (must contain uppercase, number, symbol, no repeated characters, etc.) actually produce weaker passwords than simpler length-based policies. Users respond to complex rules with predictable patterns:
# What users actually do when forced to add complexity:
password → Password1!
password → P@ssw0rd!
summer2024 → Summer2024!
john → John123!
# Every single one is in attacker dictionaries
The best password policy, according to NIST and modern security research, is: minimum 8 characters (encourage 15+), check against breached password lists, no forced composition rules, no periodic mandatory changes. Let users choose long, memorable passphrases rather than forcing them to create short, complex strings they'll write on sticky notes.
Real-World Password Breach Statistics
What Makes a Password "Strong Enough"?
The answer depends on the threat model — what you're protecting and from whom:
LOW STAKES
Forum, news site, social media
12+ chars, any type
~70 bits. Resists online attacks. 2FA recommended but not critical.
MEDIUM STAKES
Email, shopping, streaming
16+ chars, mixed types
~105 bits. 2FA strongly recommended. Use a password manager.
HIGH STAKES
Banking, crypto, cloud storage
20+ chars, all types + 2FA
~130+ bits. Hardware key 2FA mandatory. Unique password, never reused.
CRITICAL STAKES
Password manager master, encryption keys
25+ char passphrase + HW key
~160+ bits. Hardware security key required. Memorized, never written down.