How Strong Is Your Password? What Makes One Hard to Crack

Adding a capital letter and a number to "password" doesn't make it strong. To see why, it helps to understand how attackers actually guess passwords — and what makes one genuinely hard to crack.

A padlock on a laptop keyboard

Strength is about how guessable it is

Attackers rarely try every combination in order. They start with:

The most common passwords ("123456", "password", "qwerty").
Common words and names, with predictable tweaks (P@ssw0rd, Summer2026!).
Patterns: keyboard runs (qwerty), sequences (abc, 1234) and repeats (aaaa).
Everything else, by brute force.

A password that's on their first lists falls in seconds, however "complex" it looks.

Entropy: measuring unpredictability

Password strength is often measured in bits of entropy. Each bit doubles the number of guesses needed. A rough estimate is:

entropy ≈ length × log₂(character pool size)

A pool of 26 lowercase letters gives about 4.7 bits per character; adding uppercase, numbers and symbols raises it to about 6.5 bits. But length matters most: every extra character multiplies the work, while adding a symbol type adds far less.

Estimated crack time

Crack time depends on the attack. If someone steals a database of password hashes, they can test billions of guesses per second offline. The Password Strength Checker assumes 10 billion guesses per second, and averages half the search space. Real speeds vary a great deal depending on how the site stores passwords, so treat any crack time as a rough guide.

What makes a password weak

Being common — even long, common phrases can be in wordlists.
Predictable substitutions — "a" to "@" and "o" to "0" are the first things attackers try.
Repeats and sequences — "aaaaaa" or "abcd1234" carry far less entropy than their length suggests.
Personal information — names, birthdays and pets are easy to find.
Reuse — one breach exposes every account sharing that password.

A hand holding a brass padlock

What makes a password strong

Length — 12 characters is a sensible minimum; more is better.
Randomness — generated, not invented.
Uniqueness — a different password for every account.
Passphrases — four or five unrelated random words are easy to remember and hard to guess.

Need one? Use the Password Generator, and store it in a password manager.

Checking privately

The strength check runs entirely in your browser; your password isn't sent anywhere. Still, avoid typing a password you use on important accounts into any website. Test a similar one instead.

FAQ

Is a longer password always better? Generally yes — but not if it's predictable. A long, common phrase is weaker than a shorter random one.

Do I need symbols? They help, but length and randomness matter more.

How often should I change passwords? Change one if you suspect it's been exposed. Constantly rotating strong, unique passwords isn't needed.

Try it now

Check a password with the free Password Strength Checker.