Most strength meters measure the wrong thing. They award points for character classes — is there a capital? a digit? a symbol? — which answers whether a password satisfies a corporate rule, not whether anyone can guess it.
P@ssw0rd1 has all four classes. It is in every cracking dictionary ever assembled, and the letter substitutions are the first thing any cracking tool undoes. It falls in well under a second.
So this looks for the cheapest way the string could have been produced, rather than the most flattering one. Every pattern found lowers the estimate, because the cheapest route is the one an attacker takes.
And one thing worth stating plainly: "no pattern found" is not "no pattern". The list here is small and illustrative; a real attacker works from hundreds of millions of leaked passwords. This is a best case, not a guarantee.
Nothing you type is sent anywhere. The estimate is computed in your browser by this site’s own calculation engine — there is no request carrying it, nothing written to storage, and nothing logged. That said, the habit of typing a real password into any website is a bad one to build, and a site that wanted your password would say exactly what this page says. If you would rather not, change one or two characters: the estimate will be close enough to be useful.
Because character types are not what makes a password hard to guess. “P@ssw0rd1” appears in every cracking dictionary ever assembled, and the substitutions are the first thing a cracking tool undoes — it falls in well under a second. Meters that add points for an uppercase letter and a symbol are measuring whether a password satisfies a corporate complexity rule, which is a different question from whether anyone can guess it.
Because length multiplies the work in a way variety does not. Every character added multiplies the search space by the size of the alphabet, while swapping one letter for a symbol merely widens the alphabet slightly. A memorable phrase of four or five unrelated words is both stronger and easier to type than a short string of punctuation.
It is the base-two logarithm of how many guesses an attacker would have to work through. Each extra bit doubles that. Under 30 bits is trivially breakable, around 60 is reasonable for something with a rate limit in front of it, and 75 or more is what you want for anything protecting real value on its own.
From the bit count, assuming a trillion guesses a second — an offline attack on a fast rig against a password stored with a weak hash. The rate is printed beside the estimate because a crack time with no stated rate is not a claim about anything. A well-defended login with rate limiting is many orders of magnitude slower to attack, and a badly stored password can be faster.
No, and this is the most important thing on the page. This checks a small illustrative list of common passwords and a handful of recognisable shapes. A real attacker works from hundreds of millions of passwords leaked in breaches, plus name lists, dates and dictionaries in many languages. A pattern this page does not recognise may well be one they have — so treat the figure as the best case, never as a guarantee.
Current guidance says no, not on a schedule. Forced rotation pushes people towards small predictable edits — the same password with the month on the end — which is exactly the shape this page flags. Change it when you have reason to think it has been exposed, use a different one on every site, and let a password manager remember them.
Each extra bit doubles the number of guesses. It is not a gradual scale — the gap between 40 and 50 bits is enormous.
One has every character class. The other is lower-case letters only. Length multiplies; variety merely widens slightly.
Nothing you type is transmitted or stored. The estimate is an upper bound on strength, not a floor: it reports the patterns it recognises, and a pattern it misses may still be one an attacker has. Never read 'no weaknesses found' as 'no weaknesses'. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
