🔧 TL3 Tools

Every password strength checker on the internet shows you a meter, a score out of 100, or a label like "strong" or "weak." The labels feel subjective, but the score underneath them is arithmetic. Once you know the two numbers a checker multiplies together, you can look at any password and predict roughly where the meter will land.

The two numbers are the length of the password and the size of the character pool it draws from. A checker combines them into a figure called entropy, measured in bits, and then converts bits into an estimated crack time. This post walks through that math with worked examples you can verify in a few minutes.

What a Strength Score Is Really Counting

A strength score is an estimate of how many guesses an attacker would need before finding your password. That number is expressed as a power of two, because each added bit doubles the search space. A password with 30 bits of entropy needs about 2³⁰ guesses, roughly one billion. A password with 40 bits needs 2⁴⁰, roughly one trillion. The gap between 30 and 40 bits is not 33 percent more security; it is a thousand times more guesses.

The per-character contribution is the logarithm base 2 of the pool size. A character chosen from a pool of N possible characters carries log₂(N) bits. Multiply that by the length of the password and you have the total entropy, assuming every character was chosen randomly and independently.

The Pool Size Changes the Math

The character pool is where length trades against variety. Lowercase letters form a pool of 26, which works out to log₂(26) ≈ 4.7 bits per character. Add uppercase letters, digits, and symbols and the pool grows to about 94 characters, worth log₂(94) ≈ 6.55 bits per character. The difference matters: a 10-character password from the full pool carries about 65.5 bits, while a 10-character all-lowercase password carries about 47 bits. Twenty bits of difference means roughly a million times more guesses.

This is why checkers that ask you to use every character class are not being pedantic. Adding one symbol character to a password is worth more than adding two lowercase letters, because each symbol character contributes more bits.

Worked Example: Two Passwords, Very Different Numbers

Take the password sunnydays. It is 9 characters long, all lowercase, so the pool is 26 and each character contributes 4.7 bits. Total entropy: 9 × 4.7 ≈ 42.3 bits. Guessing it requires 2^42.3 attempts. The password strength tester on this site assumes an attacker can make about 10 billion guesses per second, a reasonable figure for a dedicated GPU cracking a fast hash. Dividing 5.6 trillion guesses by 10 billion per second leaves about 560 seconds. That password falls in under ten minutes.

Now take aX9#mQ2$vL7. Eleven characters, every class represented, pool of 94: 11 × 6.55 ≈ 72 bits. That is about 4.7 × 10²¹ guesses. At the same 10 billion per second, cracking it takes roughly 4.7 × 10¹¹ seconds, which is close to 15,000 years. The meter is not guessing; it is doing this division.

The striking part is how little the visible difference costs. Nine lowercase letters and eleven mixed characters look comparable on screen. In search space they are about nine orders of magnitude apart.

Why the Score Drops for Patterns

Checkers that only count pools and lengths give you the optimistic number. Most modern checkers also recognize patterns, and the score drops when they find one. Dictionary words, keyboard walks like qwerty, repeated characters, and common substitutions such as replacing every a with @ all shrink the effective search space.

A password like Pa$$w0rd looks like eight characters from the full pool, about 52 bits by the naive formula. A pattern-aware checker sees the dictionary word "password" with two trivial substitutions and rates it far lower, because an attacker with a word list will hit it in the first few billion guesses. The gap between the apparent score and the effective score is exactly the gap between math that assumes randomness and reality where humans choose the password.

Crack Time Is an Order-of-Magnitude Guess

The crack time a checker reports is an estimate built on assumptions. The 10 billion guesses per second figure suits fast hashing algorithms. Password managers and modern sites use deliberately slow hashing, like bcrypt or Argon2, which can cut that rate by a factor of thousands. An attacker with a botnet, or with stolen hardware, changes the numbers again. Treat any crack time as a rough ranking, not a schedule.

The ranking itself is what you should rely on. If a checker says two passwords are 40 and 70 bits, the second is genuinely about a billion times harder to crack regardless of which hardware assumptions the checker used.

What the Score Does Not Tell You

Entropy measures offline guessing resistance only. It says nothing about phishing, where the attacker asks you for the password directly, or credential stuffing, where the password was leaked from another site and replayed here. A 90-bit password is worthless if you reuse it everywhere. The score also cannot detect a password already sitting in a breach database; only a check against leaked lists can do that.

Use a strength meter to confirm the password you generated is long and varied, then protect it with the practices the meter cannot see: a unique password per site, a password manager to generate and store them, and two-factor authentication on accounts that matter.

Checking Your Own Passwords

The password strength tester on this site runs entirely in your browser, so the passwords you test never leave your device. Type in a few candidate passwords and watch how the score responds to length versus variety. You will see the 4.7-bits-per-lowercase-letter math from this post show up directly in the results.