📖 How Password Strength Works
Password strength is a measure of how resistant a password is to guessing or brute-force attacks. In its simplest form, it estimates how many attempts an attacker would need to make, on average, to find the correct password by trying combinations systematically.
What Is Information Entropy?
Entropy, in the context of passwords, is measured in bits and represents how many yes/no decisions an attacker's search would need to correctly guess the password. A password with 60 bits of entropy is significantly harder to crack than one with 30 bits — every additional bit doubles the number of possible combinations, so entropy grows exponentially, not linearly, with length and character variety.
Why Character Variety Matters Less Than Length
Adding a symbol to your character set increases the base of the exponent (charset size), but adding characters to your password's length increases the exponent itself — and exponents dominate. A 16-character password using only lowercase letters (26 options per character) actually has more entropy than an 8-character password using all four character types (94 options per character), because 26¹⁶ vastly exceeds 94⁸. This is why long passphrases are often both stronger and easier to remember than short, "complex" passwords.
Tips for Strong Passwords
- Length is king: A long password made of simple words (a passphrase) is often stronger and easier to remember than a short, complex one.
- Use a password manager: Don't try to remember unique passwords for every site — use a reputable manager to generate and store long, random passwords.
- Avoid common patterns: Dictionary words, "123456", and keyboard patterns (qwerty) are the first things attackers' cracking dictionaries try.
- Enable multi-factor authentication: Even a strong password benefits from a second layer of verification on important accounts.
❓ How long should my password be?
Current security guidance recommends a minimum of 12 characters, though 16 or more is preferred for critical accounts like email, banking, or password managers themselves.
❓ Does this tool send my password anywhere?
No. This calculation is performed entirely locally in your browser using JavaScript. Your password is never transmitted, logged, or stored — it never leaves your device.
❓ Why does the "time to crack" estimate assume 1 trillion guesses per second?
This reflects a realistic modern offline attack using specialized hardware (GPUs or ASICs) against a leaked password hash database. Online, rate-limited login attempts are far slower, so real-world cracking time against a live login form is typically much longer than the estimate shown here.