Last updated
Checking a Weak Password
Evaluating a commonly used password:
Password: password123
Strength: Very Weak (1/4)
Entropy: 8 bits
Issues detected:
✗ Contains dictionary word "password"
✗ Ends with sequential digits "123"
✗ Appears in breach databases (billions of times)
✗ Only 11 characters
Estimated crack time:
Online (throttled): 3 minutes
Offline (fast hash): Less than 1 second
Suggestions:
→ Use a passphrase of 4+ random words instead
→ Avoid dictionary words and predictable patterns
Checking a "Looks Strong" but Weak Password
A password that passes naive checkers but is actually weak:
Password: P@ssw0rd!
Strength: Weak (1/4)
Entropy: 12 bits
Issues detected:
✗ Based on dictionary word "password" with common substitutions
✗ Predictable substitutions: a→@, o→0 are known to attackers
✗ Appears in breach databases (common pattern)
Estimated crack time:
Online (throttled): 1 hour
Offline (fast hash): 2 seconds
Note: This password meets many complexity rules (uppercase, lowercase,
digit, special char) but is still weak because the pattern is predictable.
Checking a Strong Random Password
Password: K#9mP2@vR7nB4wL8j
Strength: Very Strong (4/4)
Entropy: 104 bits
Positive factors:
✓ 16 characters (good length)
✓ Uppercase letters present
✓ Lowercase letters present
✓ Digits present
✓ Special characters present
✓ No dictionary words detected
✓ No predictable patterns
✓ Not found in breach databases
Estimated crack time:
Online (throttled): Centuries
Offline (fast hash): ~1.4 × 10^14 years
Checking a Passphrase
Four random words score well despite no special characters:
Password: correct-horse-battery-staple
Strength: Strong (3/4)
Entropy: 52 bits
Analysis:
✓ 28 characters (excellent length)
✓ Not a single dictionary word (4 separate words)
✓ Hyphen separators add unpredictability
✗ All lowercase (minor weakness)
✗ Individual words are common
Estimated crack time:
Online (throttled): Centuries
Offline (fast hash): ~36 years
Improvement: Add a digit or capitalize one word for 60+ bits of entropy
→ Correct-horse-battery-staple7
Keyboard Walk Pattern Detection
The checker recognizes keyboard patterns that look random but aren't:
Password: qwerty123
Strength: Very Weak
✗ Keyboard walk pattern detected: "qwerty"
✗ Sequential digits: "123"
Password: 1qaz2wsx
Strength: Very Weak
✗ Keyboard column pattern detected: "1qaz", "2wsx"
Password: zxcvbnm
Strength: Very Weak
✗ Keyboard row pattern detected
These patterns are in every attacker's wordlist.
Date and Name Pattern Detection
Password: john1990
Strength: Very Weak
✗ Likely contains a name: "john"
✗ Likely contains a birth year: "1990"
✗ Name + year is one of the most common password patterns
Password: Summer2024!
Strength: Weak
✗ Season + year pattern is extremely common
✗ Predictable capitalization (first letter only)
✗ Exclamation mark at end is a known pattern
Password: MyDog$Buddy2019
Strength: Weak
✗ Contains likely pet name: "Buddy"
✗ Contains year: "2019"
✗ Predictable structure: Word + Symbol + Word + Year
Entropy Explained
Understanding the entropy display:
Entropy Possible combinations Crack time (offline)
28 bits 268 million Instant
40 bits 1 trillion Minutes
52 bits 4.5 quadrillion Hours to days
64 bits 18 quintillion Years
80 bits 1.2 × 10^24 Thousands of years
100 bits 1.3 × 10^30 Longer than universe age
128 bits 3.4 × 10^38 Effectively infinite
Each additional bit of entropy doubles the number of possible passwords. Going from 52 to 64 bits (adding 12 bits) makes the password 4,096 times harder to crack.
Improving a Weak Password
Step-by-step improvement based on checker feedback:
Start: password → Very Weak (8 bits)
Step 1: password123 → Very Weak (8 bits) — digits don't help much
Step 2: mypassword123 → Weak (12 bits) — longer but still predictable
Step 3: mypassword123! → Weak (14 bits) — special char helps slightly
Step 4: Xk9mP2vR7nB4wL → Strong (91 bits) — random characters
Step 5: Xk9mP2vR7nB4wL8j → Very Strong (104 bits) — 16 chars, all types
Better approach — passphrase:
purple-mountain-river-cloud → Strong (52 bits) — memorable and strong
purple-mountain-river-cloud-7 → Very Strong (58 bits) — add a digit
Why Reusing Passwords is Dangerous
Even a strong password becomes a liability when reused:
Scenario: You use "K#9mP2@vR7nB4wL8j" on 5 sites.
Site A suffers a data breach → your password is exposed.
Attacker tries your password on:
✗ Site B (email) — success, reads your email
✗ Site C (bank) — success, accesses your account
✗ Site D (work) — success, corporate breach
✗ Site E (social) — success, account takeover
Solution: Use a unique password for every account.
A password manager makes this practical — you only remember one master password.