How to Check Password Strength: What the Score Actually Means

Most password strength checkers show you a colored bar and a label like "Weak" or "Strong." What they rarely tell you is what that score is actually measuring. Understanding the mechanics behind password strength helps you write better authentication logic, give users more useful feedback, and avoid the false security of passwords that look complex but crack quickly.

This guide breaks down what password strength really means, how checkers evaluate it, and how to test any password instantly using the free Password Strength Checker on DevToolShack.

What Password Strength Actually Measures

At its core, password strength is a measure of how long it would take an attacker to guess a password through brute force or dictionary attacks. Two factors drive that estimate more than anything else: length and the size of the character set the password draws from.

The formal measure is entropy, expressed in bits. Entropy tells you how many possibilities an attacker has to search through. The formula is straightforward:

entropy = log2(character_set_size ^ password_length)
          = password_length * log2(character_set_size)

A password using only lowercase letters (26 characters) has log2(26) ≈ 4.7 bits of entropy per character. Add uppercase (52 characters) and you get 5.7 bits per character. Add digits and symbols (roughly 95 printable ASCII characters) and you reach about 6.5 bits per character. Length multiplies all of that.

Character Set Size vs Length: Which Matters More

Both matter, but length wins at scale. Compare these two passwords:

• P@ssw0rd! — 9 characters, full 95-character set, ~58 bits of entropy
• correcthorsebatterystaple — 25 characters, lowercase only, ~117 bits of entropy

The second password, composed entirely of lowercase letters with no numbers or symbols, is vastly stronger. That surprises most people because the first one looks complex. This is why modern password guidance from NIST (SP 800-63B) focuses on length rather than complexity requirements.

Why Simple Entropy Is Not the Whole Story

Raw entropy assumes the password was chosen randomly. Human-chosen passwords almost never are. Attackers know this, which is why real-world attacks use dictionary attacks, rule-based mutations, and pattern detection rather than pure brute force.

A good password strength checker does more than count characters. It also looks for:

• Dictionary words — "password", "dragon", "sunshine" and thousands of others appear in every wordlist attackers use.
• Common substitutions — replacing "a" with "@" or "e" with "3" is so predictable it barely adds strength. Crackers apply these rules automatically.
• Keyboard patterns — "qwerty", "123456", "zxcvbn" are trivially guessable.
• Repeated characters — "aaabbbccc" has high entropy on paper but low practical strength.
• Known breached passwords — passwords from previous data breaches circulate in cracking dictionaries.

The most widely-used open-source library for this kind of analysis is zxcvbn, developed by Dropbox. It estimates crack time by matching the password against multiple attack scenarios and returning a score from 0 (very weak) to 4 (very strong), along with estimated crack times for different attack speeds.

How to Read a Password Strength Score

Strength checkers typically map scores to qualitative labels. Here is how the zxcvbn scale roughly translates to practical security:

• Score 0 (Very Weak) — Crackable instantly. Common words, short passwords, keyboard walks.
• Score 1 (Weak) — Crackable in seconds to minutes. Slightly modified dictionary words.
• Score 2 (Fair) — Crackable in hours to days with a good GPU rig. Probably fine for low-value accounts.
• Score 3 (Strong) — Crackable in months to years with dedicated hardware. Suitable for most purposes.
• Score 4 (Very Strong) — Practically uncrackable with current technology. Appropriate for sensitive accounts and encryption keys.

What Makes a Password Actually Strong

Based on the above, a genuinely strong password has these properties:

• At least 16 characters. Length is the single biggest lever. Beyond 20 characters, even simple passphrases become extremely difficult to crack.
• Random, not memorable patterns. If you can remember it easily without a password manager, it probably follows predictable patterns.
• Unique per account. Credential stuffing attacks take passwords leaked from one breach and try them everywhere else. Reuse turns one breach into many.
• Generated, not invented. Humans are bad at randomness. A password generator produces genuinely unpredictable strings. The Password Generator on DevToolShack lets you set length and character sets and generates cryptographically random passwords in your browser.

Using the Password Strength Checker

The Password Strength Checker evaluates passwords entirely in your browser. Nothing is sent to a server. It checks entropy, detects common patterns and dictionary matches, and returns a score with an explanation of what is reducing strength when applicable.

It is useful in a few different contexts:

• Testing passwords before you use them, to catch weak choices you might not notice.
• Evaluating the output of a password generator to confirm it meets your requirements.
• Auditing existing passwords you already use, to decide which accounts need a password rotation.
• Development and testing, to verify that your own app's strength meter behaves correctly by comparing it against a reference implementation.

Strength Checkers in Your Own Apps

If you're building a registration form, a good password strength indicator does more than block weak passwords. It educates users about why a password is weak and what would make it stronger. A few implementation notes:

Avoid complexity rules like "must contain uppercase, number, and symbol." NIST explicitly recommends against them because they produce predictable patterns ("Password1!") without meaningfully improving security. A minimum length requirement combined with a strength check produces better outcomes. For password storage, always use a dedicated password hashing algorithm. The post on BCrypt hashing covers why fast hash functions like MD5 and SHA-256 are wrong for passwords, and what to use instead.

The Relationship Between Strength and Storage

Password strength at input is only half the equation. Even a very strong password is at risk if it is stored incorrectly. Plain text storage, reversible encryption, and fast hashes like MD5 or SHA-256 all leave users exposed when a database is breached. BCrypt, Argon2, and scrypt are designed to be slow and configurable, so that even a leaked hash database is costly to crack. The strength of the original password and the strength of the hashing algorithm work together.