🔧 TL3 Tools

What Strength Actually Measures

Password strength is an estimate of how many guesses an attacker would need before finding your password. The tester converts that estimate into two readable outputs: an entropy figure measured in bits and an approximate time to crack at ten billion guesses per second. Higher numbers mean more work for the attacker, and the score out of 100 lets you compare candidates at a glance.

Worked Example: Tr0ub4dor&3 vs a Passphrase

The familiar Tr0ub4dor&3 mixes uppercase letters, digits, and a symbol, which looks impressive at first. Its apparent entropy is about 72 bits, but the substitutions are predictable, so the effective figure collapses to roughly 28 bits. At ten billion guesses per second that password falls within hours. The passphrase correct-horse-battery-staple looks far plainer, yet its 25 lowercase characters carry about 117 bits of entropy, and the meter rates it far above the mangled word, because guessing time grows with length, not with visual complexity.

Why Ten Billion Guesses per Second

The crack-time figure assumes a determined attacker running a cluster of GPUs, because that is the realistic threat for a stolen hash. It is an order-of-magnitude estimate, not a precise countdown, since real hardware changes every year and some algorithms slow down guessing dramatically. Treat the number as a label: seconds and hours are unacceptable, weeks are borderline, and years are the goal.

How Entropy Gets Estimated

Each character drawn from a pool of N possibilities contributes log2(N) bits, so total entropy is length multiplied by that per-character figure. Longer pools push the number up, which is why mixing character classes helps, but only if the mix is not the well-known pattern. The estimate treats every position as independent, which is generous when a password follows a recognizable template.

What the Entropy Bits Really Mean

Each bit doubles the number of possible guesses, so a password with sixty bits is roughly a thousand million times harder to guess than one with thirty bits. Comparing candidates by their bit counts gives a fairer ranking than looking at the characters, because bits measure the search space directly. The meter shows the raw estimate so you can see why a longer phrase outranks a complicated short string.

Patterns That Lower the Score

• Common passwords from breach lists, like password123 or qwerty.
• Keyboard walks, such as 1qaz2wsx or asdfghjkl, typed along a row.
• Number sequences, including 123456, 654321, and repeated runs.
• Repeated characters or single-character tails that shrink variety.

Any match against these lists deducts points and adds a specific suggestion to the feedback panel.

Reading the Meter and Suggestions

The score bar fills in real time as you type, with colors shifting from red through yellow to green as the estimate climbs. Beside the bar, the panel lists the entropy in bits, the projected crack time, and a breakdown of which character classes your password uses. When the estimate drops, the suggestion lines explain which pattern triggered the penalty.

Why Length Beats Clever Substitutions

Every extra character multiplies the guess space, while a clever substitution only swaps one character for another. Attackers know that 0 stands for o and 4 stands for a, so those tricks add almost no protection. A long passphrase made of ordinary words outperforms a short string of random-looking characters precisely because its length compounds the search space.

Passphrases Done Right

Four or five unrelated words, joined with spaces or hyphens, beat a shorter string of random characters because the total length compounds. Choose words that are not a famous quote, a song lyric, or a phrase about your hobby, since attackers feed those into their dictionaries. The tester rewards exactly this shape: high length, mixed classes, and no recognizable pattern.

Password Managers and Long Random Strings

A password manager generates and stores a unique string for every site, so you only ever need to remember one master passphrase. The strings it produces score at the top of this meter by construction, because they are long and drawn from the full character set. Pasting one into the checker confirms the score without ever revealing it to a third party.

Checking While You Type

There is no button to press because the analysis runs on every keystroke. Delete a character and the meter recalibrates instantly, which makes experimentation painless: try adding a word, a number, or a symbol and watch the estimate respond. That immediate feedback is the fastest way to learn what actually moves the needle.

Credentials That Stay in the Browser

Your password never leaves this tab. The scoring logic, the pattern lists, and the entropy math all run locally, so you can paste a real candidate without exposing it to a server or a log file. When you close the page, the field clears, leaving no trace of what you typed.