Question 1

Can I type my real password here? Does it go to a server?

Accepted Answer

All the analysis runs in JavaScript in your browser. The password is not sent, not saved to local storage and does not appear in analytics events. Still, take care: do not type it on a shared computer, remember that browser extensions can read text fields and, if you prefer, test a password similar to yours, with the same format, instead of the real one.

Question 2

What is password entropy?

Accepted Answer

Entropy measures, in bits, the size of the space of possibilities a secret was drawn from: each bit doubles the number of combinations. For a randomly drawn password it is length × log2(alphabet size). A 16-character password from a 95-symbol alphabet has about 105 bits. The calculation only holds for truly drawn passwords: when a person makes up the password it follows patterns and real entropy is lower, which is why the pattern model exists.

Question 3

Why does length matter more than complexity?

Accepted Answer

Each extra character multiplies the combinations by the alphabet size, while adding a character type only enlarges the alphabet a little. And required complexity tends to produce predictability: most people put the capital letter first and the number or symbol last, exactly where the attacker looks first. That is why NIST SP 800-63B-4 requires a minimum length of 15 characters for a password used as the only factor and says mandatory composition rules should not be imposed.

Question 4

Why does the tool show two estimates, by characters and by patterns?

Accepted Answer

The by-characters one is a theoretical ceiling: it assumes each character was drawn at random from the alphabet. It serves as a comparison, and for truly generated passwords it matches the second. The by-patterns one estimates how many guesses an attacker who knows common patterns would make, and is the one used for the rating. When the two drift apart, the difference in bits is the cost of the patterns found, which appear highlighted in the password.

Question 5

How are crack times computed and what do the 3 scenarios mean?

Accepted Answer

Time = guesses ÷ guesses per second. In the online scenario with a limit the attacker tries on the service itself, which blocks and throttles: we assume 100 guesses per hour. In the offline scenarios the attacker already has the hashes from a breach: with a slow hash (bcrypt, argon2) we assume 10 thousand per second, and with a fast hash with no cost factor, 10 billion per second on one GPU. They are simplified hypotheses, and real hardware and parameters change the result by orders of magnitude. As a worked example, 2^40 guesses at 10^10 per second give about 110 seconds.

Question 6

How does pattern detection work and what are its limits?

Accepted Answer

The tool looks for predictable parts (common passwords, words and names, sequences, qwerty and abnt2 keyboards, repetitions, dates and years, leet swaps, capital letter only at the start) and picks, by dynamic programming, the split of the password that would be guessed with the fewest tries. It is a lightweight version, written for this site, with small built-in lists. A real attacker has dictionaries of hundreds of thousands of entries, so the estimate is optimistic for human-made passwords. Use it as a floor and as a guide to what to change, not as a verdict.

Question 7

Has my password appeared in any breach?

Accepted Answer

The local check compares against a small list of about 450 very common passwords, and only catches the worst cases. To query a real database, use the site's leaked password checker, which queries Have I Been Pwned's Pwned Passwords by k-anonymity: only the first 5 characters of the SHA-1 hash leave the browser, and the final comparison is local. If the password shows up, do not use it anywhere, even if the strength result is good.

Question 8

Why doesn't swapping a for 4 or o for 0 help?

Accepted Answer

Because attackers know these swaps and include them in their dictionaries: p4ssw0rd costs almost the same as password. The tool recognizes common leet swaps and counts only a small multiplication for the variations, so the common word is still what decides the strength. To gain real strength, add unpredictability (drawn words, more characters), do not disguise the word.

Question 9

Is a passphrase good? How is it scored here?

Accepted Answer

Yes, as long as the words are drawn at random and the phrase is long, because the attacker has to hit whole words in order. For phrases of 3 or more words the tool uses a per-word model (14 bits per word, a common dictionary of about 16 thousand words) instead of the per-character count, which overstates. If the words came from a generator with a 1024-word list, each is worth 10 bits. Phrases taken from songs, books or sayings are much weaker, because the attacker tries known phrases.

Question 10

Do I need to change my passwords from time to time?

Accepted Answer

Not on a schedule. NIST SP 800-63B-4, the US government digital identity guideline, says verifiers should not require periodic password changes, and should force a change when there is evidence of compromise. Forced rotation leads to predictable passwords (Password1, Password2). Change when there is a sign of a leak, suspicious access or a shared password, and use a strong, unique password so you do not have to change for no reason.

Question 11

Are password managers and two-factor authentication worth it?

Accepted Answer

Yes, both. A manager allows a long, random, unique password per service without relying on memory, and fills only on the correct site, which helps against phishing. The second factor protects the account even if the password leaks, but does not replace the password: prefer passkeys or hardware keys, which resist phishing, over SMS. Memorize only one strong passphrase for the manager's master password.

Question 12

Does an Excellent rating mean the password is unbreakable?

Accepted Answer

No. It says that, from what the password shows, an attacker would need an enormous number of guesses to get it by guessing. It does not cover reuse across sites, phishing, malware that captures what you type, a service leaking the password in plain text or with a weak hash, or people who know you. The password is only one layer: use a unique one per service, in a manager and with 2FA.

Password Strength Auditor