Guides / Security basics

How to Check Password Strength (and What the Scores Miss)

A password strength meter gives a quick estimate, but it is not a guarantee. Length matters most, and the most common real attacks rely on patterns and reuse, which a simple score does not see.

How the estimate works

A common estimate multiplies the password length by the logarithm of the number of possible characters. Using lowercase, uppercase, digits and symbols gives 94 possible characters. A 15-character password with all four types gives about 98 bits, which is strong for most uses.

What the score misses

• Common words: Password1! looks complex to a score, but attackers try common words first.
• Reuse: a strong password reused on many sites can still be stolen when one site leaks it.
• Leaked passwords: a password found in a past breach is risky, whatever its score.

Practical advice

• Aim for at least 12 to 16 characters, and make each one unique.
• Use a password manager to generate and store them.
• Turn on two-step verification for important accounts.

Try it yourself

The Password Strength Checker runs in your browser. The password you type is not stored or sent anywhere.