What makes a password hard to guess
A password is attacked in two main ways: someone tries guesses against a login form, or someone who has stolen a database of stored hashes tries guesses offline at very high speed. In both cases, what protects you is how many possibilities an attacker has to try. Length is the biggest lever, since every extra character multiplies the number of combinations. Mixing lowercase letters, uppercase letters, numbers and symbols widens the pool of possibilities for each character.
Randomness matters even more. A long password made of a common phrase, a keyboard pattern or a name with a year added can fall quickly to guesses built from known habits. Unique use matters too: a password reused on several sites is only as safe as the weakest of them.
When a quick check is useful
A checker is handy when you are choosing a password by hand or reviewing the rules you would like a signup form to enforce. It gives immediate feedback on length and character variety without an account.
Treat the result as a conversation starter, not a verdict. If you simply need a strong value rather than a grade, the Password Generator creates random passwords, and a password manager lets you use a different one for every account.
How to use the checker and how the score is calculated
- Type or paste a password into the "Enter a password to check" field. It is hidden by default, and the eye icon shows or hides it.
- A colored bar, a label and a checklist appear once the field is not empty.
- Read the checklist to see which rules the text meets, and adjust until you are satisfied.
The score is a simple count of six yes-or-no checks, one point each: at least 8 characters, at least 12 characters, contains a lowercase letter, contains an uppercase letter, contains a digit, and contains a symbol (any character that is not a letter or digit, spaces included). The total, from 0 to 6, picks the label: Very weak, Weak, Fair, Good, Strong, Very strong or Excellent for 0 through 6, and the bar fills by score divided by 6. The checks are run in your browser and the page says the password is never sent anywhere.
Limits of this rough heuristic
This is a rough heuristic, not a security audit. It does not look at word lists, repeated characters, keyboard runs or leaked-password databases. It only counts length and character classes.
That produces some misleading results. "Password1!" has 10 characters with all four character types, so it earns 5 of 6 and the label Very strong, even though it is one of the most predictable patterns people use. "Password1234!" has 13 characters, scores the full 6 and is labelled Excellent, which it clearly is not.