Sean Sanders

Most password strength meters lie to you.

Type Password123! into almost any signup form and the bar turns green. Twelve characters, uppercase, lowercase, a digit, a symbol — it satisfies every rule the form checks. It is also one of the first passwords an attacker tries, and it falls in well under a second.

The tool below scores passwords the way an attacker would. Type something in, and it will show you the real number and where that number came from.

How to use it

The widget has two tabs.

Checking a password

Open Check strength and type a password into the box. Everything updates as you type — there is no button to press and nothing is submitted anywhere.

You get four things back:

1. A coloured meter — a quick read, red through green.
2. A verdict — Very weak, Weak, Fair, Strong, or Very strong.
3. The entropy in bits, and how long the password survives an offline attack.
4. Specific advice — what is wrong with this password, not generic rules.

Use the Show button to reveal what you have typed if you want to check for a typo.

The interesting part is How this score was calculated. Open it, and you will see your password broken into the pieces the checker recognized, each with its own cost:

Password123!    real strength: 16.7 bits — cracked instantly
  ├── "Password"   common word        2.0 bits
  ├── "123"        digit run          8.1 bits
  └── "!"          unpredictable      6.6 bits

That is the whole argument in one screenshot. Treating every character as random suggests 78.8 bits. Recognizing the pattern drops it to 16.7.

Generating a password

Open Generate, and you get a new password immediately. Press Generate password for another, or Copy to put it on your clipboard.

There are two modes.

Random produces the strongest result per character. Drag Length to set the size and use the checkboxes to control which character types are included — useful when a site refuses symbols, or only allows digits for a PIN. No look-alikes removes characters that are easy to confuse (I, l, 1, O, 0), which matters if you will ever type the password by hand or read it aloud.

Passphrase produces something like entrap-marmot-linden-egress-dotcom-google-44. It is longer, but you can actually retype it from memory when a device forces you to. Each word is drawn from a 2048-word list, so every word adds exactly 11 bits. Six words give you 66 bits — comfortably strong — and the optional number brings it to about 73.

If you are choosing between the two, use Random for anything living in a password manager, and Passphrase for the handful of passwords you have to type yourself. Your device unlock code, your password manager’s own master password, your laptop login.

What the number means

Entropy in bits measures how many guesses an attacker needs. Each extra bit doubles that. It is a log scale, so the difference between 40 and 60 bits is not 50% more work — it is about a million times more.

The crack times assume an offline attack against a fast hash at roughly 100 billion guesses per second, which is achievable with consumer graphics hardware. That is the pessimistic case, and it is the right one to plan around, because you have no say in how any given website stores your password.

Aim for 60 bits on accounts you would rather not lose and 80 or more on email, banking, and your password manager. Email deserves the most care, because whoever controls it can reset everything else.

Why the usual strength meters get it wrong

The standard meter computes log2(poolSize) × length. Count the character types you used, calculate the size of that pool, and raise it to the password length.

That formula assumes every character was chosen uniformly at random. People do not do that. We pick a word, capitalize the first letter, put a digit or two on the end, and swap an o for a 0. Attackers know this, and their tools try those shapes long before they try anything resembling brute force.

So the formula is not wrong so much as it is answering a different question. It tells you how strong your password would be if you generated it at random. It says nothing about the password you actually chose.

This checker takes a different approach: it looks for the structures people actually use, prices each one at the cost of guessing it, then finds the cheapest way to assemble your whole password from those pieces. That cheapest route is the one an attacker takes, so its cost is your real strength.

What it recognizes

Anything it does not recognize falls back to standard pool entropy, which is the honest figure for genuinely random characters. A generated password gets full credit.

This is the same method as zxcvbn, Dropbox’s password estimator, reimplemented in a compact form.

Is it safe to type my password here?

Yes — and you should not have to take that on trust.

The tool makes no network requests. Every calculation runs in JavaScript on your own machine. Nothing is transmitted, nothing is logged, nothing is written to storage, and there is no server on the other end to receive it. There is no analytics call attached to the input.

Two ways to check for yourself:

• Open your browser’s developer tools, switch to the Network tab, and type into the box. It stays empty.
• Load this page, disconnect from the internet, and keep using it. It works exactly the same.

That said, a good general habit is to be wary of typing a real password into any website that asks for one. This one is safe because it never leaves your browser, but if you would rather not, test something with the same shape instead — same length, same structure, different characters. You will get essentially the same score.

Where the generator’s randomness comes from

The generator uses crypto.getRandomValuesthe browser’s cryptographic random number generator. It never uses Math.random, which is seeded predictably and is not safe for anything you intend to rely on.

One detail that matters more than it sounds like it should: converting random bytes into a character index value % alphabetSize introduces bias whenever the alphabet size does not divide the range evenly. For a 62-character alphabet drawn from 8-bit values, the first eight characters come up measurably more often than the rest. The password looks fine. Its real entropy is quietly lower than the number on the screen.

The generator avoids this with rejection sampling — values above the largest exact multiple of the alphabet size are discarded and redrawn. Every character is exactly equally likely, so the bit count it reports is exact rather than estimated.

Four habits that matter more than any single password

Length beats complexity. Every character you add multiplies the search space. Adding one character to a random 20-character password does more for you than any amount of symbol-sprinkling on a short one.

Never reuse a password. This is the big one. A strong password used on three sites is only as safe as the least careful of those three. When one is breached, attackers replay the same email and password across other accounts — it is the single most common way ordinary accounts get taken over. Credential stuffing does not care how strong your password was.

Use a password manager. It is the only practical way to have a different strong password for every account. You memorize one passphrase; it handles the rest. Generate the master passphrase in the tool above, and make it long.

Turn on two-factor authentication. Even a perfect password can be phished. A second factor means a stolen password alone is not enough. App-based codes or hardware keys are meaningfully better than SMS, which can be intercepted via SIM swapping.

Add this tool to your own site

The widget is free to embed on any site, commercial or not. It has no dependencies, no build step, no tracking, and makes no network requests — so the privacy claim above holds true on your site too, and you can tell your own visitors the same thing.

<div data-password-widget></div>
<script src="https://artbarts.com/wp-content/uploads/2026/08/wordlists.js" defer></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/entropy.js" defer></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/generator.js" defer></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/password-widget.js" defer></script>

The four scripts must load in that order. Attribution is appreciated but not required.

Full Example Below

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Password Strength Checker &amp; Generator</title>
<meta name="description" content="Check how strong your password really is and generate a stronger one. Runs entirely in your browser — nothing is ever sent or stored.">
<style>
  :root {
    --bg: #ffffff; --fg: #14161a; --muted: #5b6472; --line: #dfe3e8; --soft: #f6f7f9;
  }
  @media (prefers-color-scheme: dark) {
    :root { --bg: #101317; --fg: #e9edf2; --muted: #98a2b3; --line: #262c35; --soft: #171b21; }
  }
  * { box-sizing: border-box; }
  body {
    margin: 0; background: var(--bg); color: var(--fg);
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
    line-height: 1.65; -webkit-font-smoothing: antialiased;
  }
  .wrap { max-width: 680px; margin: 0 auto; padding: 56px 20px 80px; }
  header { text-align: center; margin-bottom: 32px; }
  h1 { font-size: clamp(1.75rem, 5vw, 2.4rem); line-height: 1.2; margin: 0 0 12px; letter-spacing: -0.02em; }
  .lede { color: var(--muted); font-size: 1.05rem; margin: 0 auto; max-width: 34em; }
  .widget-host { display: flex; justify-content: center; margin: 0 0 48px; }
  h2 { font-size: 1.25rem; margin: 40px 0 12px; letter-spacing: -0.01em; }
  h3 { font-size: 1rem; margin: 24px 0 8px; }
  p { margin: 0 0 14px; }
  .content { border-top: 1px solid var(--line); padding-top: 8px; }
  .content p, .content li { color: var(--muted); }
  .content strong { color: var(--fg); font-weight: 600; }
  ul { padding-left: 22px; margin: 0 0 14px; }
  li { margin-bottom: 6px; }
  code {
    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
    font-size: 0.9em; background: var(--soft); border: 1px solid var(--line);
    border-radius: 5px; padding: 1px 5px;
  }
  table { width: 100%; border-collapse: collapse; margin: 16px 0; font-size: 0.94rem; }
  th, td { text-align: left; padding: 9px 10px; border-bottom: 1px solid var(--line); }
  th { font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); }
  td:first-child { font-family: ui-monospace, Menlo, Consolas, monospace; font-size: 0.9rem; }
  .table-scroll { overflow-x: auto; }
  footer { margin-top: 48px; padding-top: 20px; border-top: 1px solid var(--line);
           font-size: 0.85rem; color: var(--muted); text-align: center; }
  a { color: inherit; }
</style>
</head>
<body>
<div class="wrap">
  <header>
    <h1>How strong is your password?</h1>
    <p class="lede">Test any password against the patterns real attackers try first — then generate one that holds up. Everything happens in your browser.</p>
  </header>
  <div class="widget-host">
    <div data-password-widget data-credit="false"></div>
  </div>
<script src="https://artbarts.com/wp-content/uploads/2026/08/wordlists.js"></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/entropy.js"></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/generator.js"></script>
<script src="https://artbarts.com/wp-content/uploads/2026/08/password-widget.js"></script>
</body>
</html>

Frequently asked questions

What makes a password strong?

Unpredictability, not complexity. A strong password is one that an attacker’s guessing strategy will not reach quickly, which means length and randomness rather than a particular mix of character types. A random 16-character password and a six-word random passphrase are both strong. P@ssw0rd! satisfies every complexity rule and is not.

How long should my password be?

For a randomly generated password, 16 characters puts you comfortably past 90 bits. For a passphrase, six words. If you are choosing a password yourself rather than generating one, length matters even more, because your choices are less random than they feel.

Are passphrases as secure as random passwords?

They can be, provided the words are chosen randomly and there are enough of them. Six words from a 2048-word list are 66 bits. The catch is that a phrase you invent is far weaker than one drawn at random — quotes, song lyrics, and phrases that mean something to you are all in the space attackers search. Randomness has to come from the generator, not from you.

Is it safe to use an online password generator?

It depends entirely on whether the generation occurs in your browser or on someone else’s server. If a password is generated server-side, that server saw it. This generator runs in your browser using crypto.getRandomValues, and the result is never transmitted. You can verify that with your browser’s network tab.

How often should I change my password?

Only when you have reason to — a breach notice, a shared password, or a suspicion that something is wrong. Scheduled expiry is no longer recommended; NIST’s guidance dropped it because forced rotation pushes people toward predictable variations (Spring2025! becoming Summer2025!), which is worse than leaving a strong password alone.

What is password entropy, in plain terms?

It is a count of how many guesses separate an attacker from your password, expressed as a power of two. Forty bits means about a trillion guesses. Each additional bit doubles it. It is useful precisely because it collapses length and unpredictability into one number you can compare.