How passwords are attacked · 5 min read

How password strength meters work

A strength meter guesses how an attacker would guess. Different meters model the attacker differently, which is why they disagree.

Type the same password into three sign-up forms and you may get three verdicts: weak, fair, strong. None of the meters is broken in the sense of having a bug. They are answering a question that has no exact answer, using different assumptions about how an attacker would guess. Researchers who reverse-engineered the meters of 11 popular web services found, in their words, “severe inconsistencies in strength outcomes that may confuse users.”

Two different numbers called “strength”

It helps to separate two things that both get called entropy.

Generator entropy is exact. When a password comes from a random generator, you know the size of the set it was drawn from, and every member was equally likely. Six words drawn uniformly from the 7,776-word EFF list give 7,776^6 possibilities, so 6 × log2(7,776) = 77.55 bits. Nothing about the output changes that number. This site’s generators compute strength this way, from their settings, never from the result. See entropy explained.

An estimate for a typed password is a guess about a guess. The meter does not know how the password was made. It can only look at the string and ask: what is the cheapest way an attacker could arrive at this? The answer depends entirely on what the meter knows about attackers’ methods. NIST’s appendix on password strength puts it simply: “While entropy can be readily calculated for data with deterministic distribution functions, estimating entropy for user-chosen passwords is challenging.”

How meters estimate

Most meters fall into one of three styles.

Rule counting

The oldest style awards points for length and for each character class present: lowercase, uppercase, digits, symbols. Some multiply length by the bits of the combined character pool. This rewards exactly the habits attackers exploit, such as a capital at the start and 1! at the end, and it has no idea that P@ssw0rd is a famous password.

Pattern matching

A better style tries to break the string into pieces an attacker would guess as units: words from dictionaries and leak lists, names, dates and years, keyboard walks, repeats like aaaa, sequences like abcd or 2468, and common letter-for-symbol swaps. Each piece gets a cost based on how many alternatives an attacker would have to try, and the meter looks for the combination with the lowest total. The result is far closer to how guessing tools actually work, though it is only as good as its dictionaries and rules.

Model-based

Research meters train statistical models on leaked passwords to predict how many guesses a password would take. They can be more accurate, but they need large models and can be hard to explain.

Worked example: one string, three answers

Take the passphrase canyon-harbor-violin-anchor: four words, all from the EFF list, separated by hyphens. It is 27 characters long.

The rule counter overstates it by more than 100 bits, because it treats each letter as independent when the letters come in whole words. The pattern matcher lands close to the true figure, but only because its dictionary contains the EFF list. A meter with a different dictionary might find some of the words and spell out the rest letter by letter, landing somewhere in between.

The reverse can happen too. Password1! is 10 characters from all four classes, worth 10 × log2(94) = 65.55 bits under rule counting. A pattern matcher sees the most common password on its list, capitalized, with a digit and a symbol appended, and scores it at a small fraction of that. NIST uses this very string as its example of what composition rules produce.

Why a low score is more trustworthy than a high one

A meter’s estimate is an upper bound on how hard a typed password is to guess, never a guarantee. If the meter found a pattern, an attacker can find it too, so a low score is reliable. If the meter found no pattern, that only means it did not know the one used. A personal pattern (a pet’s name and a house number) will not be in any dictionary, but it may be in an attacker’s targeted guesses.

This is the core difference from generator entropy. A generated password’s number is exact because the process is known. A typed password’s number is an estimate because the process is not.

How this site’s checker works

The strength checker uses the pattern-matching approach and shows every step. For the password you type, it looks for the cheapest explanation of the string from:

• a match against the bundled 10,000-entry common list, after undoing capitals and common letter-for-symbol swaps
• words from the EFF wordlist
• keyboard walks, repeats and sequences
• dates and years
• otherwise, a per-character cost based on the character’s class

It adds up the bits for each segment and prints each line, so you can see which part of the password carries the weight and which part is costing nothing. It is an approximation and says so. It does not query any breach service, and nothing you type leaves the browser.

Note: If you want a number you can rely on, generate the password instead of estimating it. The password generator and passphrase generator report exact entropy from their settings.

What meters are for

NIST requires services to “offer guidance to the subscriber to help the subscriber choose a strong password,” particularly after rejecting a blocklisted one. A good meter is that guidance: it explains why a password is weak in terms a person can act on, rather than just turning red. A meter that only counts character classes tends to push people toward Password1!. A meter that explains patterns pushes them toward length and randomness.

Summary

• Meters disagree because each models the attacker differently.
• Generator entropy is exact; an estimate for a typed password is an upper bound.
• Rule-counting meters overrate decorated words and can underrate long all-lowercase passphrases; pattern-matching meters are closer but depend on their dictionaries.
• Trust a low score; treat a high score as “no pattern found,” not “safe.”
• This site’s checker is approximate and shows its working line by line in the strength checker.

General explanation, not advice for a particular situation. Updated 2026-10-31.