The most common question is whether the entered password is stored or sent anywhere. It isn't - everything runs in your browser using JavaScript, with no network requests made when you type. The scoring itself is a simple 7-point length-and-character-variety checklist, though - it doesn't catch predictable patterns like P@ssw0rd or Summer2024!, which would score well here despite being well-known to attackers.
Exactly how does this tool calculate the strength score?
It counts how many of 7 fixed checks your password passes: 8+ characters, 12+ characters, contains uppercase, contains lowercase, contains a number, contains a special character, and isn't an exact match to one of 6 common passwords (password, 123456, qwerty, admin, letmein, welcome). The count (0-7) maps to a level from Very Weak to Very Strong. There's no entropy calculation, no zxcvbn library, and no broader dictionary or pattern-matching engine involved.
Does this tool catch predictable passwords like P@ssw0rd?
No. "P@ssw0rd" passes 6 of the 7 checks (everything except the 12-character length check) and is rated "Strong" by this tool, because the common-password check only matches 6 exact literal words and doesn't recognize letter-to-symbol substitutions. If you want to avoid predictable patterns like this, that judgment call is on you - the checklist alone won't flag it.
What makes a password strong?
Length is the most important factor - an additional character multiplies the attack space. A 16-character random password is exponentially stronger than a 10-character one. After length: character variety (uppercase + lowercase + numbers + symbols). After variety: unpredictability - avoiding dictionary words, names, dates, and predictable substitutions (P@ssw0rd is not strong in practice, despite meeting typical complexity requirements). This is general password-security guidance - this tool's own 7-point checklist doesn't check for predictable substitutions, so it will still rate a password like P@ssw0rd as "Strong."
Is my password sent to a server when I check it?
No - this tool runs entirely in your browser. The password is evaluated using JavaScript locally; no network request is made. You can verify this by disconnecting from the internet and opening the tool - it still works. Never enter passwords into online tools that send data to a server. A client-side strength checker like this one is safe to use with real passwords.
What is the recommended password length?
NIST SP 800-63B (2017, updated guidelines) recommends a minimum of 8 characters for human-generated passwords, but security professionals recommend 12–16 characters minimum for general accounts, and 20+ characters for high-value accounts (banking, email, password manager master password). Passphrases (4+ random words) like 'correct-horse-battery-staple' are both long and memorable.
What is the difference between password strength and password security?
Strength measures how hard the password is to crack by brute force or dictionary attack. Security also depends on: where the password is stored (is the site breached?), whether you reuse it across sites (one breach exposes all), whether you use two-factor authentication (adds a second layer even if the password is stolen), and whether the site hashes passwords correctly. A strong unique password + 2FA is genuinely secure.
Why do common complexity rules (uppercase + number + symbol) not guarantee strong passwords?
Rules like 'must contain uppercase, number, and symbol' were designed when computers were slow. Modern GPU-accelerated attacks can test billions of passwords per second. Common patterns - Password1!, P@ssw0rd, Summer2024! - are in real-world cracking dictionaries, even though this tool's own 6-word common-password list won't catch them. A truly strong password is random and long, not just complex. A random 12-character password of any mix is far stronger than a predictable 12-character 'complex' password.