PassCheck

How strong is it really?

Evaluated in this page, by a deliberately pessimistic estimator. No ad code and no analytics on this page — nothing that could watch the field.

Network measuring… Ad code none on this page

This page carries no advertising and no analytics — the only page in this network that is deliberately unmonetised, because a password field deserves it.

Why this page has no ads

Every other page in this network carries advertising, which is what pays for it. This one does not, and the omission is deliberate. Ad code cannot read a form field it was not given access to, so the risk here is technical rather than real — but a password strength checker surrounded by third-party scripts fails the test any careful person would apply, and being right on a technicality is not the same as being trustworthy. The page is worth more unmonetised.

A deliberately pessimistic estimator

Most strength meters are generous, because a green bar feels better than a red one. They reward a capital letter and a trailing digit, which is exactly the transformation attackers assume you have made. Password1 satisfies most complexity policies ever written and is among the first hundred guesses of any attack.

This estimator starts from length and character variety, then charges the password nothing for structure it recognises: known-common passwords, English words, keyboard runs, tripled characters, years, digit sequences. Crucially it undoes letter-for-symbol substitutions first, before any other check — because swapping a for @ and o for 0 is the single cheapest rule in a cracker's list, so P@ssw0rd is evaluated as password, and reported as breakable in under a second.

What the crack time means and does not mean

The figure assumes an offline attack at a hundred billion guesses a second against a fast hash — a serious attacker who has obtained a password database and is working on it with good hardware. It is intentionally the pessimistic case. If the site that holds your password used a deliberately slow hash, the true figure is vastly longer; if they stored it badly, this estimate may be optimistic. You have no way to find out which, which is the argument for length.

If a password you use returns anything below "strong", the useful response is not to add a symbol to it. It is to replace it, and to stop using it anywhere else — reuse is the mechanism that turns one breach into several.

Replace it with something better

Passphrase generatorSix random words — memorable and 62.7 bitsPassword generatorRandom characters with the entropy shown

Questions

Is my password being sent anywhere?
No, and this page is built so that it cannot be. There is no analytics script, no ad script — the ad code that funds the rest of this network is deliberately omitted from this page — and no request of any kind is made after load. Everything you type is evaluated by JavaScript already in the page. Open DevTools, watch the Network tab, and type: nothing happens, which is the point.
How is the estimate calculated?
It starts from length and character variety, then subtracts for the structures that real cracking tools exploit: known-common passwords, dictionary words, keyboard runs, repeated characters, years, digit sequences, and letter-for-symbol substitutions. The substitutions are undone before anything else is checked, because that is the first rule any cracker applies — which is why P@ssw0rd here scores the same as password rather than looking respectable.
Why does it disagree with other checkers?
Because most are far more generous. A checker that rewards you for adding a capital and a digit will call Password1 strong; it is one of the most-guessed passwords in existence. This one is deliberately pessimistic — it will occasionally call a genuinely fine password merely fair, which costs you nothing, rather than calling a guessable one strong, which could cost you an account.
What does the crack time assume?
An offline attack at 100 billion guesses per second — a well-resourced attacker with good hardware against a fast hash. That is a deliberately harsh assumption. Against a slow hash like bcrypt the real figure would be many orders of magnitude longer, but you cannot know which a given site used, so the estimate assumes the worse case.
Should I type a password I actually use?
The page is designed so that doing so is safe, and the design is verifiable in ten seconds with your browser's Network tab. That said, a reasonable habit is to test the shape rather than the secret — change a couple of characters and evaluate that. Good security advice is to never type a live password into a site you have not checked, and this page would rather reinforce that instinct than ask you to make an exception for it.