How the estimate is worked out
The checker first works out the size of the alphabet you used, for example 62 characters for upper and lower case letters plus digits, and multiplies the length by its log2. That is what the password would be worth if every character were picked at random. It then looks for cheaper explanations: a run like 4567 counts as one guess among a few hundred, not four random digits, and a keyboard walk or a year counts the same way. The lowest total wins, which is how an attacker’s guessing tools think too.
Why common passwords and disguises fail
Lists of leaked passwords show the same choices again and again: 123456, password, qwerty, iloveyou, names and football clubs. Attackers start with those lists, then try each entry with the first letter capitalised, letters swapped for look-alike symbols such as @ for a or 0 for o, and digits or a year added on the end. That is why Password1! or P@ssw0rd2024 score badly here even though they tick every box on a typical sign-up form. The checker undoes these swaps before comparing.
Reading the crack times
The three times assume different attacks. Against a website that limits login attempts, even a modest password may survive, which is why online numbers look long. The danger is a leaked database: if the site stored passwords with a slow hash such as bcrypt, an attacker might manage ten thousand guesses a second; with a fast hash, graphics cards can manage billions. You rarely know how a site stores passwords, so judge your password by the offline numbers.
What this checker cannot know
The estimate cannot see your personal life. A password built from your child’s name and birthday may score well here but be easy for someone who knows you. Nor can it tell whether a password has appeared in a past data breach or is reused on several sites, which matters more than its strength. Treat any result near the line as weak, and never reuse a password, however strong it scores.
Privacy and sources
The password is checked by code running in this page. Nothing is sent to our server: the analytics only note that a check took place, never the password, its length or its rating. The list of 10,000 common passwords is a static file from the open SecLists project, used under the MIT licence, and it downloads when the page opens whatever you type.