How to Check if Your Password is Strong (and What "Strong" Actually Means)

Passwords are the authentication layer for almost every online account. Most of what passes for "password advice" is folklore ("add a number and a symbol") that does not match how password crackers actually work. The real metric is entropy — the amount of randomness in the password, measured in bits. A 12-character password made of mixed case, digits, and symbols has more entropy than an 8-character one with three substitution tricks, because the longer the password, the more possibilities the cracker has to try.

What makes a password weak

Three failure modes, in order of how common they are:

1. Too short. Below 10 characters, a brute-force attack (trying every possible combination) is fast. A 6-character password is crackable in seconds. An 8-character one in hours. The 12+ character rule is the single biggest move you can make.
2. Reused across sites. The most common way accounts are compromised is not a cracker; it is a leak on a different site, where the user used the same email and password. The attacker takes the leaked email + password combo and tries it on every other major site. This is called "credential stuffing" and it works depressingly well.
3. Pattern-based. "Password1!", "Summer2024", "qwerty12345", "Tr0ub4dor&3" — these all look strong but follow patterns crackers check first. A real password has no pattern; every character is independently random.

Length and uniqueness matter far more than character variety. A 20-character password of all lowercase letters is stronger than an 8-character password with mixed case, digits, and symbols.

How password crackers actually work

The reason the folklore is wrong: real-world crackers do not try every possible combination. They try the combinations people actually use, in the order people use them. A modern cracker runs through the following list in this order:

1. Top password lists. "password", "123456", "qwerty", "admin" — millions of attempts per second. Cracked in seconds.
2. Wordlist + common suffixes. Dictionary words with "1", "!", "2024", "123" appended. "Summer2024!" is in this category. Cracked in minutes.
3. Pattern-based mutations. "P@ssw0rd", "Tr0ub4dor&3" — the XKCD-style substitutions. Cracked in hours to days.
4. Mask attacks. If the cracker knows the password is "8 characters, lowercase + digits", they try every combination matching that mask, in order of likelihood. Cracked in hours.
5. Brute force. Every possible combination. For an 8-character password with mixed case + digits + symbols, this is around 10^14 combinations — at a cracker speed of 10 billion attempts per second (a consumer GPU can do this), it is about 3 hours. For a 12-character password, it is 10^22 combinations — about 300,000 years at the same speed.

The "8 characters with mixed case + digits + symbols is strong" advice is a 2005 rule that has not aged well. Hardware has gotten faster; brute force at 8 characters is now feasible. The 2025 rule is 12+ characters, randomly generated, unique per site.

How to check your password strength

The fastest path: open the password strength checker in your browser, type a password (or paste a candidate), and the tool reports the estimated time to crack it, the entropy in bits, and what is making it weak. The whole analysis runs locally — the password never leaves the page, and a quick test of the network tab confirms no upload.

What the report tells you:

• Entropy in bits. The amount of randomness. 60+ bits is "fine for non-critical accounts", 80+ bits is "strong for personal accounts", 100+ bits is "future-proof for the next 10 years at cracker speed improvements".
• Time to crack. How long a modern GPU would take to find the password by trying every combination. A good password shows "centuries" or longer. A weak one shows "seconds" or "hours".
• What is making it weak. Common patterns (dictionary words, repeated characters, sequential keys like "qwerty"), low character variety, low length. The report names the issues so you can fix them.

Note: a tool can only tell you how the password fares against an attacker who tries every combination. It cannot tell you whether the password is in a leaked database. For that, use a service like Have I Been Pwned — and accept that you have to send at least the first 5 characters of a hash of the password to check it. (The k-anonymity model they use is good; the password itself is never sent.)

How to generate a strong password

For new accounts, the right answer is a randomly generated password from a password manager. The browser-based password generator produces cryptographically random passwords (using the browser's crypto API, not a weaker PRNG) with configurable length and character set. The minimum for a new account should be 16 characters; 20 is better. The output is shown once in the browser, copied to your clipboard, and never stored anywhere by the tool itself.

For accounts that do not allow random passwords (some banks cap length at 12-16 and reject symbols), a "passphrase" is the next-best option: four to six random words joined together, like "correct-horse-battery-staple" (the XKCD example). The entropy comes from the word choice, not the character variety. A five-word passphrase from a 10,000-word dictionary has about 66 bits of entropy — strong for most uses, easier to remember than a random string.

How to remember all these passwords

You do not. That is the job of a password manager. The manager stores the randomly generated passwords for every site, encrypts them with a master password you do remember, and fills them in when you log in. The manager's master password is the only password you actually need to remember — make it 20+ characters, random, and backed up somewhere safe (a printed copy in a safe deposit box, a sealed envelope at home, etc.).

Reputable password managers (Bitwarden, 1Password, KeePass, Proton Pass) all work the same way: encrypted vault, master password, browser extension. Pick one based on price and ecosystem fit. The wrong answer is the browser's built-in password manager for anything important — it works, but it ties your passwords to one browser and one account, which is a single point of failure.

Two-factor authentication (2FA) is the second lock

Even the strongest password is not enough. A password can be leaked, phished, or stolen from a database the user has no control over. The second lock is two-factor authentication: a one-time code from a separate device that an attacker does not have.

The TOTP generator tool explains how time-based codes work (and lets you check what your authenticator app is generating). For any account that supports 2FA, enable it. Authenticator apps (Authy, Google Authenticator, Bitwarden, 1Password) are far better than SMS, which is vulnerable to SIM-swap attacks. Hardware security keys (YubiKey, Titan) are the gold standard for high-value accounts.

Quick checklist for password hygiene

1. Check your existing passwords with the strength checker. The ones under 12 characters, the ones that are dictionary words, the ones you have reused — change them.
2. Use a password manager for new accounts. Generate 16+ character random passwords. The manager remembers them; you do not.
3. Enable 2FA on every account that supports it. Authenticator app or hardware key, not SMS.
4. Check Have I Been Pwned for your email. If you appear in a known leak, change the password on that account and any other account that used the same password.
5. Do not reuse passwords. One leak on a small forum should not compromise your email, your bank, and your social media. The password manager makes this easy.