Password Strength Checker

Most strength meters count character classes — one capital, one digit, one symbol — and rate `P@ssw0rd1` as strong. It is one of the worst passwords in existence. Every cracking tool tries dictionary words first, then the same words with `a` swapped for `@` and `o` for `0`, then those with a digit appended. Rules about character classes measure whether a password annoyed the person who chose it, not whether it resists guessing.

This estimates the thing that actually matters: how many guesses are needed. That starts from the size of the alphabet and the length, then applies real penalties for patterns that collapse the search space — a common word, a keyboard run like `qwerty`, a sequence like `1234`, a repeated block, or a four-digit year. A pattern does not subtract a token amount from the score; it caps it, because a password that is guessable in a thousand attempts is guessable in a thousand attempts however many symbols it contains.

The crack time assumes an offline attack at 100 billion guesses a second against a fast hash. That is deliberately pessimistic. A well-built service stores passwords with bcrypt or Argon2, which are slow on purpose and would take far longer — but you do not control how a service stores yours, and the sensible assumption is the worst realistic case.

The single most effective change is length. Four unrelated words are both stronger and easier to remember than a short scrambled string, which is why `correct horse battery staple` outscores `Tr0ub4dor&3` here — and why it is the example everybody cites.

The common-password list is short by necessity: a real checker compares against a corpus of millions of leaked passwords, and shipping one to your browser is not practical. Passing this check is not proof your password is unbreached. Use a password manager and a unique password per service, and the question stops mattering.

Everything runs in your browser and nothing is sent, stored or logged. Even so, the sensible habit is not to type a password you actually use into any web page — including this one. Try a variation.