How to Check Password Strength: What Makes a Password Weak or Strong
Most password strength meters are misleading. "Tr0ub4dor&3" scores high on basic checkers — it has uppercase, lowercase, numbers, and symbols — but appears in major password lists and would be cracked quickly. Real strength comes from entropy, not complexity rules.
What Is Password Entropy?
Entropy measures unpredictability in bits. For a random password, entropy = log₂(charsetSize ^ length). The larger the character set and the longer the password, the more guesses an attacker needs.
Entropy = length × log₂(charset_size) Lowercase only (26 chars), 12 chars long: 12 × log₂(26) = 12 × 4.7 = 56.4 bits Full ASCII (94 printable chars), 16 chars long: 16 × log₂(94) = 16 × 6.6 = 105 bits
At 100 billion guesses/second (GPU cracking), 56 bits takes ~1 year; 80 bits takes longer than the current age of the universe. Modern recommendations: aim for 80+ bits of entropy.
How Password Strength Checkers Work
Simple rule-based checkers
Check for uppercase, lowercase, numbers, and symbols. Fast but easily fooled — "Password1!" scores 100% despite being trivially crackable. Avoid relying on these.
Entropy-based checkers
Calculate theoretical entropy based on character set size × length. Better than rule-based, but doesn't account for common patterns like "p@ssw0rd".
Dictionary + pattern checking (zxcvbn)
Dropbox's open-source library. Tests against 30,000 common passwords, keyboard patterns (qwerty, 12345), dates, names, and l33tspeak substitutions. Estimates real-world crack time. This is the gold standard for UX password meters.
Have I Been Pwned check
Checks your password against 600M+ breached passwords using k-Anonymity (only sends the first 5 chars of the SHA-1 hash). If it's been breached, it's blacklisted regardless of complexity.
Why Complexity Rules Fail
The famous NIST guidelines (SP 800-63B) updated in 2020 explicitly state that complexity rules are counterproductive. Here's why:
Predictable substitutions
Users respond to "must include a number" by adding "1" at the end. "Must include a symbol" → they add "!" at the end. These patterns are well-known to crackers.
Shorter passwords
Complexity rules push users toward shorter passwords that satisfy the rules. A 16-char random lowercase password beats an 8-char "complex" one.
Password cycling
Frequent forced changes lead to Password1→Password2→Password3 patterns. NIST now recommends only changing passwords when compromised.
What Actually Makes a Strong Password
Length ≥ 16 characters
The single biggest factor. Each character multiplies the search space exponentially.
True randomness
Use a cryptographically secure generator, not your brain. Human patterns are predictable.
Not in breach databases
Check against haveibeenpwned.com. If it's been leaked, it's in cracking dictionaries.
Unique per site
Reusing passwords means one breach exposes all accounts (credential stuffing attacks).
Stored in a password manager
The only practical way to use unique, random passwords everywhere.
Check or generate a strong password — free