What the checker looks for
An attacker doesn't try every possible string in order. They try the likeliest first: passwords that leaked before, words, names, dates, keyboard patterns, then those with predictable changes. So the checker asks: what is the cheapest way to describe this password? It splits the password into pieces, charges each piece the bits an attacker would need to guess it, and picks the split with the lowest total.
| Piece | Cost in bits | Example |
|---|---|---|
| On the common-password list (10,001 entries) | log2(rank + 1) | password is #1: 1 bit |
| A word from the 7,776-word dictionary | 12.9 | staple |
| Letter-for-symbol swaps undone (a→@, o→0) | +1 per swap | P@ssw0rd |
| Capitals: first or last letter, or all | +1 | Monkey |
| Capitals elsewhere | +log2(ways to place them) | moNKey |
| Typed backwards | +1 | drowssap |
| Keyboard walk, 4+ neighboring keys | log2(47 × 6) + 2 per turn + log2(length) | qwerty, 1qaz2wsx |
| A character repeated | log2(set size) + log2(count) | aaaaaa |
| A block repeated | the block once + log2(count) | abcabc |
| A sequence | log2(set size, or 1 from an obvious start) + 1 + log2(length) | 12345, xyz |
| A year 1900–2039 | log2(140) = 7.1 | 1987 |
| A full date | log2(366 × years) (+2 with separators) | 25/12/1987 |
| Anything else | per character: 4.7 for a letter, 3.3 for a digit, 5.0 for a symbol or space | kq |
How far to trust it
For a password a person made up, any strength figure is an estimate: nobody can measure how predictable a human choice is, only model it. This checker's model is small and published, so you can see exactly where it is generous or harsh. On its labelled test set it puts 71 of 90 passwords in the expected band and 87 within one band; the cases it gets wrong are listed there. Its known blind spots: names and words beyond its 7,776-word dictionary, phrases and quotations, keypad patterns, and anything personal to you (a pet's name, a street). A real attacker's lists are far larger, so treat a “strong” here as a ceiling, not a guarantee.
For a password made by a random generator, the checker doesn't know it was generated, and usually under-rates it. Use the generator's own figure, which is exact. See how strength meters work.
And it doesn't check breach databases. Doing that safely needs a call to a third-party service; this page deliberately makes none. How breach checks can work without revealing the password explains the method if you want to use one elsewhere.