How the score is calculated
The checker works in four steps, all in your browser. First it works out the character pool from what you typed: 26 for lowercase, 26 for uppercase, 10 for digits and 31 for the symbols it recognizes. A password using all four classes has a pool of 93. Second, it computes raw entropy as length × log2(pool). Third, it subtracts penalties for patterns that attackers try first. Fourth, it maps the result to one of five bands.
| Pattern found | Effect |
|---|---|
| Equals, or contains (5+ letters), an entry in its list of about 100 common passwords | Entropy capped at 12 bits |
Sequential run of 4+ such as 1234 or abcd | minus 14 bits |
| Same character 4+ times in a row | minus 14 bits |
Keyboard run of 4+ such as qwer or asdf | minus 14 bits |
| Year from 1950 to 2029 | minus 8 bits |
The bands are: under 25 bits Very weak, 25 to 40 Weak, 40 to 60 Fair, 60 to 80 Strong, 80 and above Very strong.
Reading the crack-time numbers
Crack time assumes an attacker must search half the keyspace on average, 2bits / 2 guesses. The online figure divides by 10,000 guesses per second, a rate a login form with throttling might allow. The offline figure divides by 10 billion per second, which models a stolen database of fast, unsalted hashes. Slow password hashes such as bcrypt or Argon2 make real offline attacks far slower, so treat the offline number as a pessimistic case.
A worked example
Take eight random lowercase letters, such as kqzvmbtw. The pool is 26, so entropy is 8 × 4.70 = 37.6 bits, which lands in the Weak band. That is 237.6, about 2.1 × 1011 combinations: roughly 10 seconds offline at 10 billion guesses a second, but about 121 days online at 10,000 per second. Now compare password123. It contains the list entry password, so its entropy is capped at 12 bits and it is reported as cracked "instantly", even though 11 characters of letters and digits would score 57 bits by arithmetic alone.
What this checker cannot know
- The word list is small. About 100 passwords is a sample, not the billions in real breach corpora. A password can pass here and still appear in a leak.
- Predictable structure scores too high.
Tr0ub4dor&3has no flagged pattern, so it scores 72 bits and Strong. Attackers model substitutions like0foroand a symbol and digit at the end, so the real strength is lower. - Passphrases are undervalued. Four random dictionary words are strong, but the tool measures characters, not word choices.
- Reuse is invisible. A strong password reused across sites is only as safe as the weakest site.
NIST SP 800-63B recommends screening against breached-password lists and favoring length over composition rules, which matches the tool's penalties. To make a password that scores well, use the password generator, and see the hash generator to understand what a site stores instead of your password.