Password Strength Checker: What Actually Makes a Password Strong
A password strength checker gives you a quick score, but the factors behind that score often surprise people who assume a symbol or two solves everything. This guide breaks down exactly what a strength checker measures, why some intuitive choices score poorly, and what genuinely moves your score up.
How our checker scores a password
Our Password Strength Checker runs entirely in your browser using JavaScript, so your password never reaches a server or gets logged anywhere. It combines several factors rather than relying on a single rule.
- Length. Longer passwords score higher, since each extra character multiplies the total number of combinations an attacker must try.
- Character variety. Mixing uppercase, lowercase, numbers and symbols increases the pool of possible characters at each position, which raises the number of guesses required.
- Estimated entropy. This measures unpredictability based on both length and how many unique characters the password actually uses, since repeating the same characters adds far less protection than length alone suggests.
- Common patterns. The checker flags well known weak passwords and predictable sequences, such as "password" or "123456", regardless of how long they are.
Why "clever" substitutions score lower than people expect
Swapping letters for lookalike numbers or symbols, such as replacing an "a" with "@" or an "e" with
"3", feels clever, but attackers have built these substitutions into their cracking tools for years.
A checker that only looked at raw character variety would score
P@ssw0rd! reasonably well, yet this exact pattern appears in nearly every common password
list. Genuine unpredictability comes from randomness, not from a predictable transformation applied to
a common word.
What actually raises your score
- Add length before you add complexity. Extending a password by four or five characters usually raises its score more than swapping a handful of letters for symbols.
- Avoid dictionary words and personal information. Names, birthdays and common words shrink the effective search space dramatically, even when you capitalise them or add a number at the end.
- Use a password you did not have to invent. A password generated randomly avoids every predictable pattern a human tends to fall into without realising it.
Testing a password is safe, if the tool works this way
Typing a real password into any website understandably feels risky. Our checker analyses everything locally in your browser and transmits nothing, which you can verify by disconnecting from the internet entirely: the tool keeps working. Always confirm a strength checker works this way before you trust it with a password you actually use.
From checking to generating
If your password scores poorly, the fastest fix is usually to replace it entirely rather than patch it. Our Password Generator creates a strong password instantly, and our password generator guide explains the habits that keep it safe afterward. Once you store that password somewhere, our password encryption guide explains how a well built application should hash it rather than store it directly.
Try it yourself
Check your own password's strength right now with the Password Strength Checker, entirely in your browser and never sent anywhere.
Back to all posts