Why Counting Character Types Gets This Wrong
The familiar strength formula, length multiplied by the log of the alphabet, is only correct when every character was chosen at random. Applied to a password a person invented it measures the wrong thing entirely: it asks which character types appear, not how predictable the choices were. That is why it rates sixteen repeated letters as strong, and why Password123! scores well despite appearing in every breach corpus. This tool estimates the number of guesses instead. It looks for the structures people actually use, dictionary words and names, letters swapped for lookalike digits, repeated characters and groups, alphabetical and numeric runs, adjacent keyboard keys and years, prices each one by how many guesses it costs an attacker who knows the pattern, then finds the cheapest way to assemble the whole password from those pieces. Anything it cannot explain is charged at the full brute-force rate, so genuinely random passwords still score at the top. The approach follows the published zxcvbn design with a smaller pattern set.
How to Use the Password Strength Analyser
- 1Type or paste a password. It is analysed in the page and never sent anywhere, but prefer a password you are evaluating rather than one already in use.
- 2Read the score together with the estimated guess count, which is the number an attacker actually cares about.
- 3Compare the four crack times: a rate-limited login and a stolen database of fast hashes are wildly different threats.
- 4Read the patterns section to see exactly which parts of the password were predictable.
- 5Apply the suggestions, then re-check. Adding length usually helps far more than adding a symbol.
Common Password Strength Analysis Use Cases
Check a password before you commit to it
See whether a candidate password is predictable before it becomes the one protecting an account.
Understand why a policy rejected it
Find out which part of a password is the weak link when a complexity rule passes it but a strength meter does not.
Show why a rule of thumb fails
Demonstrate that a password meeting the classic uppercase, digit and symbol rule can still be guessed almost immediately.
Compare two candidates
Put two options side by side and see the difference in guesses rather than in character classes.
Frequently asked questions
Why is Password123! rated so poorly when it has all four character types?
Because character types are not what an attacker searches. That password is a dictionary word, a predictable capital, a short digit run and a symbol at the end, which is a pattern cracking tools try early. The composition rule it satisfies was designed for a different threat and has been dropped from modern guidance for exactly this reason.
Why does a long string of one character score badly?
Because there is only one choice in it, repeated. The old formula multiplies length by the alphabet size and rewards it heavily; a guess-based estimate charges for the character and the repeat count, which is what an attacker spends.
Does swapping letters for digits help?
Barely. Substituting 4 for a and 0 for o is a standard transformation that every cracking tool applies to its wordlist, so this tool treats a leet-spelled word as the word plus a small factor, not as a random string.
Why are there four different crack times?
Because the attacker\u2019s position changes the answer by many orders of magnitude. A throttled login form allows a handful of attempts per hour, while a stolen database of unsalted fast hashes allows billions of guesses per second on rented hardware. A password can be adequate against one and hopeless against the other.
Is my password sent anywhere?
No. The wordlist and all pattern matching are packaged in the page and run on your device, so the tool works offline and nothing you type is transmitted or stored.