Understanding Password Strength: Entropy, Crack Times, and Scoring

Password strength checkers are everywhere — on signup forms, in password managers, in standalone tools like this one. But how do they actually work? What does "moderate" or "strong" mean, and where do the crack time estimates come from? This article explains the methodology behind password strength scoring, what entropy means in practical terms, and how to use this checker effectively.

How Password Strength Is Calculated

Strength checkers use a combination of techniques to estimate how resistant a password is to cracking. The most common approach is entropy estimation — calculating the number of bits of randomness in the password. This involves analyzing the character set used, the length, and whether the password contains patterns that reduce its effective entropy.

This checker evaluates several factors:

Length: Longer passwords have exponentially more possible combinations
Character set diversity: Using uppercase, lowercase, numbers, and symbols increases the character set size
Pattern detection: Repeated characters (aaa), sequences (123, abc), and common dictionary words reduce effective entropy
Predictability: Keyboard patterns (qwerty) and common substitutions (a to @) are detected and penalized

The checker combines these factors into a score from 0 to 6, which maps to a label: Weak, Fair, Good, Strong, or Very Strong. Each level corresponds to a range of entropy values and an estimated crack time.

What Entropy Means for Passwords

Entropy, measured in bits, is the fundamental unit of password strength. One bit of entropy represents a 50/50 choice — like a coin flip. Two bits represent four equally likely options (a coin flip twice). Each additional bit doubles the number of possibilities.

For a password using N possible characters and L characters in length, the entropy is L × log2(N). Here are the entropy values for common password configurations:

8 lowercase letters: 37.6 bits — crackable in hours offline
8 mixed characters (all types): 52.4 bits — crackable in days offline
12 mixed characters: 78.6 bits — practical immunity to offline cracking
16 mixed characters: 104.8 bits — beyond any feasible attack
4-word passphrase (2048-word list): 44 bits — crackable in days offline. Try our passphrase generator for higher word counts
6-word passphrase: 66 bits — practical immunity to offline cracking. Or use our custom words password generator for a secret word list

As a rule of thumb: below 40 bits is weak, 40-60 bits is moderate, 60-80 bits is strong, and above 80 bits is very strong. For high-value accounts, aim for 80 bits or more.

Crack Time Estimates Explained

The crack time shown by this checker is an estimate based on assumptions about attacker hardware and the type of attack. The estimate assumes an offline attack — the attacker has captured your password hash and is trying to crack it on their own hardware, without rate limiting.

The calculation assumes a modern GPU cluster capable of trying roughly 100 billion hashes per second for fast hash algorithms. This is conservative — sophisticated attackers with specialized hardware (like ASICs) can be faster, while well-designed services use slow hash algorithms (like bcrypt or Argon2) that are thousands of times slower to crack.

Online attacks (trying to log in): limited by rate limiting, typically 10-1000 attempts per second. Even a weak password may survive.
Offline attacks (cracking a hash): limited only by attacker hardware. A fast hash on a GPU cluster can try 100 billion per second.
Slow hashes (bcrypt, Argon2): designed to be expensive to compute, reducing crack speed by 1000x to 10000x

The crack time is a rough estimate, not a guarantee. It tells you the order of magnitude — seconds, hours, years, centuries — not the exact time. A password estimated at "100 years" could be cracked in 10 years with better hardware, or in 1 year if the service uses a fast hash.

The Strength Scale and What Each Level Means

Weak (0-1): Passwords under 6 characters or common dictionary words. Crackable in seconds to minutes.
Fair (2-3): 6-8 characters with some complexity, or longer but predictable. Crackable in hours to days.
Good (4): 10-12 characters with mixed character types. Crackable in years to decades.
Strong (5): 14+ characters with full character set, or a 5-word passphrase. Crackable in centuries.
Very Strong (6): 16+ random characters or a 6+ word passphrase. Practically uncrackable.

For most online accounts, "Good" (score 4) is the minimum acceptable level. For email, banking, and password manager vaults, aim for "Strong" (score 5) or "Very Strong" (score 6).

How to Improve a Weak Password

Add length: Each additional character multiplies the cracking difficulty. Going from 8 to 12 characters with the same character set increases entropy by 26 bits.
Add character types: If you are only using lowercase, add uppercase, numbers, and symbols. Each new type increases the character set size.
Remove patterns: Replace repeated characters, sequences, and dictionary words with random alternatives.
Use a passphrase: If you need something memorable, switch to a 5-6 word passphrase from our passphrase generator instead of a short complex password
Generate randomly: Use our password generator or strong password generator to create a completely random password, then store it in a password manager

Why Checking Password Strength Matters

Password strength checkers serve several purposes. They help you compare candidate passwords before committing to one. They educate users about what makes a password strong or weak. And they catch accidentally weak passwords — like a password that looks complex but follows a predictable pattern.

If you are deciding between two passwords, checking both lets you pick the stronger one. If you are auditing your existing passwords, checking each one helps you identify which need to be replaced. And if you are helping a less technical friend set up an account, showing them the strength meter can be an effective teaching tool.

Limitations of Strength Checkers

Strength checkers are useful but have real limitations. It is important to understand what they can and cannot tell you:

They cannot detect reused passwords — a strong password that is used on 10 sites is still a security risk
They cannot check against breach databases — a password that is strong on paper may already be in a known breach list
They cannot know if the password is written on a sticky note or shared with a coworker
They estimate entropy based on patterns, but cannot detect all patterns — a password that is a quote from a book may look random but is predictable
They assume random selection — a password chosen by a human is almost always weaker than its entropy estimate suggests

Use the strength checker as one signal among many. A "Very Strong" rating is necessary but not sufficient for good security. Also use a password manager, enable 2FA, and never reuse passwords.

Explore More Tools

Explore our other free tools for every security need. Secure your home network with our WiFi password generator, provision a team with our bulk password generator, create a unique handle with our username generator, or try our memorable password generator for shorter recallable passwords. You can also use the main password generator for full customization.