How Password Strength Is Actually Measured

Most of us have seen a password field turn from red to green with a label like 'weak' or 'strong', but what is that meter actually measuring, and can you trust it? Real password strength is about one thing: how hard the password is to guess. The Password Strength Checker estimates this in your browser without ever sending your password anywhere, and this article explains what genuine strength means and why the common advice about it is often wrong.

The uncomfortable truth is that many strength meters measure the wrong things, rewarding passwords that look complex but are easy for a computer to guess, and penalising passwords that are genuinely strong. Understanding how strength is really measured lets you see past the misleading green bar.

What entropy actually measures

The proper measure of password strength is entropy, expressed in bits, which captures how many guesses an attacker would need to try. Each additional bit of entropy doubles the number of possibilities. A password with 40 bits of entropy requires up to about a trillion guesses; one with 80 bits requires an unimaginably larger number. Entropy depends on two things: how many possible characters could be at each position (the character set) and how many positions there are (the length). Crucially, it assumes the password was chosen randomly, entropy measures the size of the haystack, not how cleverly you think you hid the needle.

Why length beats complexity

Here is the counter-intuitive result that most password rules get wrong: length contributes far more to entropy than complexity does. Adding one more character multiplies the possibilities by the size of the character set, while adding a symbol or a digit only enlarges that set slightly. A long passphrase of ordinary words, say, twenty-five characters of lowercase letters, has far more entropy than a short password bristling with symbols, like 'P@ss1!'. The familiar rule 'at least 8 characters with an uppercase, a number and a symbol' produces passwords that are both hard for humans to remember and easy for computers to crack, which is close to the worst of both worlds.

Why complexity meters mislead

Simple strength meters usually score a password by checking boxes: does it have an uppercase letter, a digit, a symbol, a minimum length. This rewards 'P@ss1!' with a good score while a genuinely strong passphrase might score lower for lacking a symbol. But attackers do not guess randomly, they start with the most likely passwords: common words, names, dates, keyboard patterns, and exactly the predictable substitutions the rules encourage. A better strength check therefore looks at whether the password resembles common patterns and dictionary words, estimating how quickly a real cracking tool would reach it, rather than just counting character types. That is a far more honest measure of strength.

How attackers actually guess

Understanding the threat clarifies what strength means. Attackers rarely try every combination from scratch. Instead they use lists of millions of previously-leaked passwords, dictionaries of words and names, and rules that apply common transformations. So a password's real weakness is predictability: if it is a common word, a name plus a year, a keyboard walk like 'qwerty', or anything that has appeared in a breach, it falls quickly regardless of how the meter scores it. The strongest passwords are the ones with no pattern to exploit, which is why randomly generated passwords and long passphrases of unrelated words are so effective.

Strong passwords in practice

The practical takeaway is simple. Favour length above all, a long passphrase of several random, unrelated words is both strong and memorable. Do not rely on predictable substitutions or a single symbol to save a short, common password. And because even a perfect password is only as safe as how it is used, never reuse one across sites, since a breach at the weakest site then exposes the others. The most reliable route to genuinely strong passwords is to let a password generator create long random ones and store them in a password manager, so you never have to remember or reuse them.

Why 'change your password every 90 days' is fading

For years, workplaces and websites forced users to change their passwords every 30, 60 or 90 days, on the theory that a regularly-rotated password limits the damage if one is stolen. Modern security guidance has largely reversed this position, and understanding why illuminates how strength really works. When people are forced to change a password frequently, they do not invent a fresh strong one each time, they make a small, predictable tweak, incrementing a number or changing a symbol, turning 'Summer2024!' into 'Summer2025!'. An attacker who has seen one of these can guess the others easily, so the rotation provides little real protection while imposing real annoyance.

The current thinking is that a strong, unique password should be changed when there is a reason to, evidence of a breach, a shared device, a suspected compromise, rather than on an arbitrary schedule. A genuinely strong, unique password that has not been exposed is not made safer by being replaced with a predictably-varied successor; if anything, forced rotation weakens the whole set by encouraging patterns. This shift reflects the broader lesson about strength: what protects you is unpredictability and the fact that a password has not leaked, not ritual compliance with a calendar. It also underscores why reuse is the real enemy, a strong password used on only one site is exposed only if that site is breached, whereas a password reused across ten sites is only as safe as the weakest of them. Focus your effort on length, uniqueness and avoiding breached passwords, and you address the things that actually determine whether a password holds up, rather than the things that merely feel like security.

In summary, password strength is really a measure of how hard a password is to guess, captured by entropy, which grows with length and character-set size, and length is by far the bigger lever. The common complexity rules mislead because attackers exploit predictability, not character types, starting from leaked lists and dictionaries. Judge a password by its unpredictability and length rather than a naive green bar, prefer long random passphrases, and never reuse them. Understood this way, the strength meter becomes a rough guide, not a verdict, and you can aim for the kind of strength that actually resists an attack.