How Strong Is Your Password? (And How to Fix It)
Most “strong password” advice is a decade out of date: P@ssw0rd! ticks every box on an old checklist and is cracked in seconds. What actually makes a password strong is simpler than the rules suggest, and you can test any password privately in your browser with the Password Strength Checker. Here’s what strength really means and how to fix a weak one.
Length beats complexity
The single most important factor is length. Each extra character multiplies the number of possibilities an attacker has to try, far more than swapping an a for an @ does. A 16-character password of random lowercase letters is dramatically harder to crack than an 8-character one crammed with symbols. So the first fix for almost any password is: make it longer.
What “entropy” means
Entropy is just a measure of how unpredictable a password is, in bits. More bits = more possible combinations = longer to guess. It depends on two things:
- Length: more characters, more entropy.
- The character pool: using lowercase, uppercase, numbers, and symbols widens the set each character is drawn from.
The Password Strength Checker estimates this entropy as you type and turns it into a rough “time to crack”, so you can compare passwords objectively instead of guessing.
How attackers actually crack passwords
Knowing the threat explains the advice:
- Brute force tries every combination. This is what length defeats: each character added makes the search exponentially bigger.
- Dictionary attacks try common words, names, and known passwords first. This is why
password,qwerty, and your pet’s name fall instantly, however many numbers you append. - Leaked-password reuse. Billions of real passwords have leaked. If you reuse one, a breach on one site hands attackers the key to your others. Never reuse passwords.
- Predictable substitutions. Cracking tools know
@ = a,0 = o,! = i.P@ssw0rd!is in every wordlist.
The fix: long, random, and unique
- Use a passphrase: four or more random, unrelated words (
copper-violin-meadow-stapler) are long, memorable, and very strong. - Or use random characters: a 16+ character random string is excellent. Generate one with the Password Generator.
- Make every password unique. A password manager remembers them so you don’t have to.
- Add length before anything else. If you must keep a memorable password, the cheapest upgrade is to make it longer.
Test yours safely
You can check any password in the Password Strength Checker without risk: it runs entirely in your browser and the password is never sent anywhere. Type a candidate, read its rating and estimated crack time, follow the tips, and you’ll have a genuinely strong password in under a minute.
FAQ
What makes a password strong?
Length first, then a mix of character types, and (crucially) being unpredictable: no dictionary words, names, dates, or keyboard patterns. A long random passphrase beats a short “complex” password.
Is it safe to type my password into a checker?
Only if the checker runs locally. The Password Strength Checker analyses your password in your browser and never uploads it, so it’s safe to test real passwords. Be wary of any tool that sends passwords to a server.
How long should my password be?
Aim for at least 12-16 characters, and longer for important accounts. With length, even simple character sets become very hard to crack.
Are passphrases really secure?
Yes: four or more genuinely random words are long, high-entropy, and easy to remember, which makes them one of the best options for a password you need to type by hand.
Should I use a password manager?
Yes. It generates long, unique, random passwords for every site and remembers them, which eliminates reuse: the single biggest real-world password risk.
Wondering if a password you use is any good? Drop it into the Password Strength Checker (it rates the strength and estimates the crack time in your browser, privately) and if it’s weak, generate a strong one with the Password Generator.