Is my password secure? How strength is measured

Many sites call your password “strong” just because it contains uppercase letters, digits and symbols. Attackers, however, guess according to how people build passwords, not by character types.

Strength is measured in bits

Password strength is usually expressed as entropy in bits. Each bit doubles the number of possibilities to try. A 40-bit password falls within minutes on modern hardware, while an 80-bit random one is practically never found. That only holds if the password is truly random.

Patterns reduce strength

Cracking tools first try leaked password lists, then dictionary words and their variants: digits for letters (a→@, o→0), years at the end, keyboard runs (qwerty, 123456) and capitalised words. “Liverpool1892!” has 14 characters but contains almost all of these patterns.

Online versus offline attacks

Guessing on a login page usually hits rate limits and account lockouts. The real danger is a site's database leaking, after which password hashes are cracked offline at billions of guesses per second. That is why a password must be strong without relying on the site's protection.

A note on testing

It is good practice never to type real passwords into online tools. Test an example with the same structure instead to see how safe your habit is.

The password strength test examines your password only in your browser, spots common words and patterns and shows an estimated cracking time. If it comes out weak, create a new one with the password generator.