Password Strength Meter

Eleven characters, an uppercase letter, a digit and a symbol: P@ssw0rd123 satisfies almost every corporate password policy ever written. Password Strength Meter scores it at 13.1 bits. That is 8,580 guesses, which a rented GPU works through before your finger leaves the key, and the distance between those two verdicts is the reason this page exists.

Character-class meters multiply length by pool size and stop. That arithmetic hands the same string 72.3 bits, because it has no way to notice the string is entry #65 on a breach list. What happens here instead is a search: the password is broken into the cheapest set of pieces an attacker already owns. Three bundled wordlists, walks along a QWERTY adjacency graph, ascending and descending runs, repeated blocks, dates and bare years all compete to cover a span, and whatever none of them can explain is priced at full value as random.

Four attack speeds sit side by side underneath, from a login form throttled to 100 tries an hour up to unsalted MD5 at 100 billion a second. Every wordlist is compiled into the page and the whole analysis reruns on each keystroke, so no password you test travels anywhere.

Walkthrough: Eleven Characters Worth 13 Bits

Load Sample types P@ssw0rd123 into the field and turns the reveal toggle on for you. Five things come back.

• Undoing the leet substitutions yields password123, which sits at rank 65 on the bundled breach list. The whole password is therefore one segment, not the four you might expect from reading it.
• That rank is doubled for the leading capital, then multiplied by the number of ways two of eleven positions could have carried a substitution. The result is 8,580 guesses, or 13.1 bits, and the verdict reads Very weak at a score of 0 out of 4.
• The attack rows come out as 4 days, 14 minutes and 1 second. The fast-hash row does not resolve to a duration at all.
• The closing suggestion does the subtraction for you: a class-counting meter would have reported 72 bits, so the recognisable patterns are eating 59 of them.
• Segment chips under How the Estimator Split It stay masked as dots while the password is hidden. They spell out the actual tokens only after you press the eye, so nobody reads your split over your shoulder unless you let them.

The Method Behind the Bit Count

Costs multiply across segments, so everything is accumulated in logarithms. A 128-character passphrase therefore lands on a finite bit count instead of overflowing a double to infinity, which is what a naive guess-count product does somewhere around 20 characters.

• Wordlist hits cost their rank. michael is fifth among the bundled first names, so it settles at 50 guesses once the floor every multi-character pattern is held to has been applied.
• Capitalisation and leet spelling multiply that rank rather than adding to it. One leading capital doubles it; a capital in the middle of a word costs more, because there are more places it could have been hiding.
• Keyboard walks are priced from the layout itself: 47 printable keys, an average of 4.6 neighbours apiece, and another factor for every change of direction along the walk.
• Runs beginning at a, z, 0, 1 or 9 are treated as one of four openings instead of one of 26, since those are the starting points a cracking rule emits first.
• Dates reduce to 365 times the distance from 2026, floored at 20 years. A bare four-digit year is a flat 200 guesses, because 1900 through 2099 is the only range worth enumerating.
• Ordering adds log2(n!) at the end. Knowing the pieces is not the same as knowing which one came first.

Not a Substitute for a Breach Check

A number here tells you how hard the password is to guess. It tells you nothing about whether it has already leaked. Those are two different questions and only one of them is answered on this page.

• The bundled lists hold a few hundred entries each. A serious cracking rig loads hundreds of millions, so a string this page calls Very strong may still be one lookup away for someone with a bigger dictionary.
• Nothing is compared against Have I Been Pwned or any similar service, deliberately, because that would mean sending the password somewhere. The trade is real: a leaked-but-random password scores well here and is worthless in practice.
• Tr0ub4dor&3 reports 72.3 bits, purely because troubador is absent from the bundled English list. Add that word and the same string collapses. Every score is a ceiling the lists happen to set, never a floor.
• Typing past the limit stops the field and raises Capped at 128 characters — the pattern scan is quadratic and no real password needs more. At the other end, one character is still measured: x comes back as 4.7 bits.
• A leading or trailing space is counted rather than trimmed, and its own warning appears, because login forms disagree with each other about whether it survives registration.