Last updated 23 August 2026
What's actually being checked
- Length — the single biggest factor. Every extra character multiplies the number of possible passwords.
- Character variety — mixing upper and lowercase, numbers and symbols increases the pool an attacker has to search.
- Common-password matching — a check against well-known weak passwords, since real attacks try these before anything random.
The entropy figure is an estimate of guessing difficulty, in bits — each extra bit doubles the number of attempts a brute-force attack would need in the worst case.
Common questions
Is my password sent anywhere when I type it in?
No. Every check runs in your browser using JavaScript running on your own device. Nothing is transmitted, logged, or stored, and it's gone the moment you close or refresh the page.
What does the entropy number mean?
It's an estimate, in bits, of how many guesses an attacker would need in the worst case. Each extra bit doubles that number. Above roughly 80 bits is considered very strong for most purposes; below 40 is weak enough to be worth changing.
Why does a common password score low even if it's long?
Real attacks don't guess randomly — they try known common passwords and predictable patterns first. "password123456789" is technically long, but it would be among the first few thousand guesses an attacker tries, so length alone doesn't make it safe.