Password Strength Analyzer

Diagnosing a Password That Scores Lower Than You Expected

If a password you thought was strong comes back "Weak" or "Fair," the first thing to check is whether it relies on character-class substitutions rather than genuine length. A password like Tr0ub4dor! checks every "must contain uppercase, digit, symbol" box but still only carries around 48 bits of entropy, because the pattern detector recognizes leetspeak substitutions (0 for o, 4 for a) as predictable — real cracking dictionaries already contain these variants pre-generated, so the tool doesn't give you credit for a substitution an attacker's wordlist already expects. If your score is lower than the raw character-set math suggests, this pattern penalty is almost always why.

A second common surprise is a long password that still scores poorly because it matches a structural pattern rather than a dictionary word — sequential digits (12345), keyboard walks (qwerty, asdfgh), repeated runs (aaa111), or the extremely common word-plus-year format (Summer2024). All of these are flagged regardless of total length, because credential-stuffing tools tried against breached account databases test exactly these transformations first. If the tool flags your password as matching a common list outright, it's capped at "Very Weak" no matter what its raw entropy calculation would otherwise suggest — that override exists because real-world breach data shows these exact passwords get guessed in the first few thousand attempts, not the billions the entropy formula would imply.

The NIST Guidance This Tool Is Built Around

The scoring model here deliberately follows NIST Special Publication 800-63B (Digital Identity Guidelines) rather than older complexity-rule conventions. NIST 800-63B recommends a length-first approach — user-chosen passwords should be at least 8 characters, with 15+ recommended for high-value accounts — and explicitly advises against mandatory composition rules requiring uppercase, digits, and symbols, because research cited in the standard shows these rules push users toward predictable, easily-guessed substitutions instead of genuine unpredictability. NIST also recommends against periodic forced password rotation, since forced rotation reliably produces incremental, guessable changes (Password1 becomes Password2) rather than fresh, independent passwords. This is why the tool rewards raw length and unpredictability over meeting a checklist of character types, and why a 20-character lowercase passphrase can outscore an 8-character password stuffed with symbols.

Two Passwords, Same Length Requirement, Very Different Outcomes

Consider two candidates that both satisfy a typical "at least 12 characters, one uppercase, one digit, one symbol" policy. The first, Winter2024!, is 11 characters and scores as Weak: it combines a dictionary word, a year, and a single symbol in a structure the pattern detector recognizes immediately, landing around 34 bits of effective entropy — crackable by a GPU cluster in well under a day. The second, horse-battery-clip-window, is 26 characters of unrelated lowercase words joined by hyphens. It has no dictionary-word-plus-suffix structure to flag, and its raw entropy calculation (26 characters across a roughly 30-character set including the hyphen) comes out well above 100 bits — into the range the tool labels "Very Strong," with an estimated crack time even a dedicated GPU rig would need longer than a human lifetime to work through. Both meet a naive complexity checklist's requirements on paper; only one is actually resistant to the way passwords get cracked in practice.

Checking Password Entropy Without a Browser

The same entropy math this tool runs in JavaScript has command-line equivalents worth knowing for scripting and automation. openssl rand -base64 24 generates a cryptographically random secret and lets you compute its theoretical entropy directly from its character set and length, which is useful when validating that a generated database password or API key meets a minimum-entropy policy in a provisioning script. The Python zxcvbn library (a port of Dropbox's original strength estimator) implements a similar pattern-matching and crack-time-estimation approach and can be called from a CI pipeline to reject weak secrets before they're committed to a secrets manager. This browser tool is the right choice for a quick interactive check or a training demonstration; reach for zxcvbn or an equivalent library in code when you need the same analysis embedded into an automated password policy check.

Frequently Asked Questions