Plenty of passwords look strong to the eye and are actually weak, and plenty of passwords look plain and are genuinely hard to crack. If you already have a password — an old one, a new idea, one a site is asking you to change — here's how to actually evaluate it, rather than guess based on how complicated it looks.
What "Entropy" Actually Means
Password strength is usually measured in entropy, expressed in bits. In plain terms, entropy is a way of describing how many guesses an attacker would need to make, in the worst case, before they find your exact password. Every extra bit of entropy doubles the number of guesses required — so a password with 40 bits of entropy isn't 20% stronger than one with 32 bits, it's 256 times stronger, because 40 − 32 = 8 extra bits and 2⁸ = 256.
Entropy comes from two things multiplied together: how many possible characters could appear at each position (the "alphabet" size — lowercase only is 26, lowercase + digits is 36, and so on), and how many positions there are (the length). Both matter, but they don't matter equally.
Why Length Beats Complexity
This surprises people: a longer password built from a smaller set of characters often has more entropy than a short password stuffed with symbols. Adding one more character to a password multiplies the total number of possible combinations by the size of your alphabet — for a lowercase-plus-digit password, that's roughly ×36 per extra character, which almost always outweighs whatever you'd gain from swapping in a symbol or two at a fixed length.
This isn't a fringe opinion — it's the direction modern security guidance has actually moved. NIST's own current password guidelines de-emphasize forced complexity rules (mandatory symbols, mandatory uppercase, etc.) in favor of simply requiring greater length, precisely because complexity rules push people toward predictable patterns while length reliably increases entropy regardless of what characters you use.
Why "P@ssw0rd1!" Is Actually Weak
At a glance, P@ssw0rd1! looks like it should score well — it has uppercase, lowercase, digits, and symbols. But it's actually one of the first passwords any real cracking tool tries, because it's a textbook example of a mangling pattern: taking a common dictionary word ("password") and applying predictable substitutions attackers already expect — @ for a, 0 for o, 1 for i or l, ! at the end. Password-cracking software doesn't brute-force character by character; it starts from dictionaries of common words and systematically applies exactly these substitutions first, because so many people use them. Complexity that follows a predictable formula provides almost no real protection.
Common Weak Patterns to Avoid
- Keyboard walks — sequences like "qwerty," "asdfgh," or "1qaz2wsx" that follow the physical layout of a keyboard rather than being random
- Sequential numbers — "123456," "2020," or any counting pattern
- Dictionary words with mangling — as covered above, substitutions attackers check for by default
- Personal information — names, birthdays, pet names — anything guessable from context or social media
- Reusing the same password across sites — worth calling out separately, because no amount of local password strength matters if the password itself has already leaked from a different site's breach
How to Check Your Password
Rather than guessing whether your password is strong enough, you can check it directly with our free Password Strength Checker:
- Type the password you're considering into the input field.
- The tool analyzes length, character variety, and common weak patterns in real time as you type.
- You'll see an actual entropy estimate along with plain-language feedback on what's helping or hurting your score.
- Adjust and re-check until you're comfortable with the result.
Everything happens entirely locally in your browser — the password you type is never transmitted anywhere or stored, which matters a lot for a tool that, by definition, asks you to type something sensitive.
What a Strength Check Can't Tell You
Any single-password strength check, ours included, has a real and honest limitation: it can only evaluate the password itself, in isolation. It has no way of knowing whether you've reused that exact password on five other sites, one of which may already have been breached. That's a different problem, and it needs a different solution — a password manager, which lets you use a unique random password everywhere without needing to remember each one. A strength checker tells you whether a password is hard to guess; it can't tell you whether it's already been compromised somewhere else.
If you're starting from scratch rather than evaluating something you already have, our guide on creating a strong password you can actually remember covers the passphrase method for building new passwords that are both memorable and strong from the start.
FAQ
Does a strong password guarantee my account is safe? No. A strong, unique password is necessary but not sufficient. Enabling two-factor authentication wherever it's offered, and never reusing passwords across sites, matter just as much as password strength itself — a strong password alone can't protect you from a breach on a site you reused it on.
What entropy score counts as "strong"? As a rough guideline, security professionals generally consider around 60+ bits reasonable for most accounts and 80+ bits solid for anything sensitive like email, banking, or a password manager's master password. Context matters, though — a slow, rate-limited login system needs less entropy to be practically safe than a database an attacker could crack offline.
Why did my password score low even though it has symbols? Symbols alone don't guarantee strength — if the underlying structure is a short, predictable word with common substitutions, the symbols barely move the needle. Length and genuine randomness matter more than which character types are present.
Is it bad to write passwords down? Writing a password on paper kept somewhere physically secure is actually far safer than reusing a weak password everywhere, since it's not exposed to the internet — though a password manager is still the better long-term solution for most people.