Password Strength Checker: What Makes a Strong Password

Password strength is not about complexity rules. It is about entropy — the mathematical measure of how difficult a password is for automated tools to guess or crack. A 20-character passphrase of random words is stronger than an 8-character string of symbols, even though the symbols look more “complex” to human eyes. Understanding entropy changes how you create and evaluate passwords.

What Determines Password Strength

Length

Length is the single most important factor. Each additional character multiplies the number of possible combinations exponentially.

Password Length	Time to Crack (Brute Force, Modern Hardware)
8 characters	Minutes to hours
12 characters	Weeks to months
16 characters	Centuries
20+ characters	Effectively uncrackable by current technology

NIST’s current guidelines recommend passwords of at least 15 characters. Our recommendation: 16 characters minimum, with 20+ preferred for critical accounts. A password manager makes long passwords practical by eliminating the need to remember them.

Unpredictability

Strength requires randomness. Patterns that humans find memorable (keyboard walks like “qwerty123,” substitutions like “p@ssw0rd,” or personal information like “fluffy2016”) are all in the playbooks of cracking tools. Dictionary attacks and pattern-matching algorithms test these variations automatically.

Truly strong passwords are either:

Generated randomly by a password manager (e.g., “kR7#mP9xQ2&vL5nW”)
Passphrases of 5 to 7 unrelated random words (e.g., “marble trumpet glacier window candle”)

Uniqueness

A strong password used on multiple accounts is not strong — it is a single point of failure. When one service is breached, every account sharing that password is compromised. Credential stuffing tools test stolen passwords across thousands of services within hours.

Unique passwords for every account are not optional in 2026. This is the primary reason password managers are essential. See our password managers comparison for the best options.

How Password Cracking Works

Understanding the attack methods clarifies why certain passwords fail.

Brute force. Testing every possible character combination. Defeated by length. An 8-character password has roughly 6 quadrillion combinations (using mixed characters). A 16-character password has approximately 3.4 x 10^38 combinations — beyond the reach of any current computing system.

Dictionary attacks. Testing common words, phrases, and their variations. Defeats passwords based on real words with simple modifications. “Sunshine123!” falls in seconds despite meeting complexity rules.

Credential stuffing. Using passwords from previous data breaches against other services. Defeats reused passwords regardless of strength. The password “X#9kL2mP!7qR” is instantly compromised on every site if it appears in a single breach database.

Rainbow tables. Precomputed hash lookups that speed up cracking for common passwords. Defeated by salting (which modern services implement) and by using uncommon passwords.

Social engineering. Bypassing the password entirely by manipulating the person or exploiting recovery mechanisms. Defended against by security questions that do not use real answers, MFA, and awareness training. See our Phishing Protection Guide 2026.

How to Create Strong Passwords

Method 1: Password Manager Generation (Recommended)

Let your password manager generate a random string of 20+ characters including uppercase, lowercase, numbers, and symbols. You never need to remember or type these passwords — the manager handles autofill. This method produces the highest entropy per character.

Method 2: Passphrase (For Passwords You Must Remember)

Generate a passphrase of 5 to 7 random, unrelated words. Use a word list or random word generator — do not pick words that are personally meaningful or thematically related.

Strong passphrase: “marble trumpet glacier window candle” Weak passphrase: “my dog fluffy loves treats” (personal, predictable, thematic)

The master password for your password manager and your device login password are the two passwords you may need to type from memory. Passphrases work best for these.

Method 3: Sentence-Based (Acceptable Alternative)

Take a memorable sentence and use the first letter of each word, mixing in numbers and symbols. “My grandmother baked 7 pies every Sunday morning!” becomes “Mgb7peSm!” This is less secure than methods 1 and 2 but far better than common passwords.

How to Check Password Strength

Reputable Online Checkers

These tools evaluate password entropy without storing or transmitting your password:

Security.org Password Checker (security.org/how-secure-is-my-password) — estimates time to crack
Password Monster (passwordmonster.com) — visualizes entropy
Bitwarden Password Strength Tester — integrated into the Bitwarden app

These tools process passwords locally in your browser using algorithms, then discard the data. They do not transmit or save your password. However, as a precaution, do not enter your actual password for critical accounts into any online tool. Enter a password of similar structure and length for an estimate.

What the Checker Tells You

Password strength checkers evaluate:

Length: Longer is stronger
Character diversity: Using uppercase, lowercase, numbers, and symbols increases combinations
Pattern detection: Known patterns (keyboard walks, repeated characters, common substitutions) reduce effective entropy
Dictionary matching: Words found in dictionaries reduce strength
Estimated crack time: Based on current computing speeds

A result of “centuries” or “millions of years” indicates adequate strength. Anything under “months” should be replaced immediately.

NIST Password Guidelines (Current)

The National Institute of Standards and Technology updated its password guidelines with several changes from traditional advice:

Minimum 15 characters (longer is better)
No mandatory complexity rules (requiring uppercase + number + symbol leads to weaker passwords like “Password1!”)
No mandatory periodic changes (change only when compromised)
Screen against breached password databases (reject any password found in known breaches)
Support passphrases (allow spaces and long strings)
No security questions (they are easily researched or guessed)

These guidelines reflect research showing that complexity rules degrade password quality by encouraging predictable patterns, while length and uniqueness provide genuine security.

Common Password Mistakes

Using personal information. Names, birthdays, pet names, addresses, and phone numbers appear in data broker databases and social media profiles. Attackers check these first.

Meeting minimum requirements. A password that barely meets a site’s requirements (8 characters, one uppercase, one number) is the weakest password the system accepts. Aim well above the minimum.

Reusing passwords. The most dangerous habit. One breach compromises every account sharing that password. Protect yourself with the online security checklist.

Storing passwords in plain text. Spreadsheets, text files, email drafts, and sticky notes provide no security. Use a password manager.

Sharing passwords via email or text. These channels are not encrypted end-to-end (email) or may be intercepted. Use your password manager’s secure sharing feature.

Key Takeaways

Length is more important than complexity — 16+ characters minimum, 20+ for critical accounts
Password managers generate and store unique high-entropy passwords for every account
Passphrases of 5 to 7 random unrelated words work for the few passwords you must remember
Never reuse passwords across accounts — credential stuffing makes reuse the biggest risk
NIST no longer recommends periodic password changes or complex character requirements

Next Steps

Choose and install a password manager
Protect against the threats passwords cannot stop in Phishing Protection Guide 2026
Secure all accounts with the Online Security Checklist
Understand identity protection in Identity Theft Protection Guide
Get answers to remaining questions in our Cybersecurity FAQ

Password cracking time estimates assume modern consumer-grade hardware (GPU clusters). State-level actors with specialized hardware may crack passwords faster. Estimates should be interpreted as approximate guidance, not guarantees.

Sources

How Secure Is My Password? — Security.org — accessed March 27, 2026
NIST Password Guidelines — Sprinto — accessed March 27, 2026
Strong Password Examples That Are Actually Secure in 2026 — StickyPassword — accessed March 27, 2026