How the Password Checker Works

1. Length and the Character Pool

The foundation of any password strength calculation is length combined with character variety. Our algorithm first inspects the password to determine which character pools are actively being used:

• Lowercase letters (a-z, pool size: 26)
• Uppercase letters (A-Z, pool size: 26)
• Numbers (0-9, pool size: 10)
• Symbols (!@#, pool size: 32)

Base points are awarded primarily for length (up to 40 points), with additional bonuses applied for utilizing multiple character pools.

2. Estimating Entropy

We calculate an Estimated Entropy value, measured in "bits." Entropy is a concept from information theory that describes the amount of unpredictability or randomness in data.

The basic formula used is: Entropy = Length * log2(Total Pool Size).

For example, a 10-character password using only lowercase letters has an entropy of approximately 47 bits. A 10-character password using all four character pools has an entropy of approximately 65 bits. Higher entropy means the password is mathematically harder for a computer to guess via a brute-force attack.

3. Pattern Penalties (The Human Element)

A purely mathematical entropy calculation is flawed if the human creates a predictable pattern. A password like "QWERTYUIOP!!!" has high theoretical entropy but is practically useless because it's a common keyboard walk.

To counteract this, our algorithm applies severe penalties for:

• Repetitive Characters: Substantial point deductions for repeating the same character three or more times sequentially (e.g., "aaa").
• Sequential Patterns: Deductions for alphabetical ("abc"), numerical ("123"), or keyboard ("qwe") sequences.
• Dictionary Hits: An immediate score of zero for universally exploited passwords like "password" or "123456".

4. Scoring and Labels

The final calculated score is normalized to a 0-100 scale, which translates to our strength labels:

• 0 - 19: Very Weak. Instantly guessable.
• 20 - 39: Weak. Vulnerable to basic dictionary attacks.
• 40 - 59: Fair. Better, but likely lacks sufficient length or contains minor patterns.
• 60 - 79: Strong. A solid password that should resist basic attacks.
• 80 - 100: Very Strong. Excellent length, high entropy, and lacks obvious human patterns.

5. The Privacy Architecture

Perhaps the most important feature of how this tool works is what it doesn't do. The tool operates 100% client-side.

When you type in the input box, the browser executes the JavaScript locally on your CPU. No API requests are made. No databases are queried. We physically cannot see the passwords you test, ensuring your digital privacy remains intact.