How the Password Strength Calculator works

The Password Strength Calculator evaluates measurable properties without transmitting the entered text. It awards points for length, character variety and uniqueness, then reduces the result when it detects common passwords, repeated characters, simple sequences, keyboard patterns, years or repeated blocks. The result is an educational estimate rather than proof that a password cannot be cracked.

The Password Strength Calculator does not query breach databases because doing so could disclose information about the entry. Check exposure through a reputable privacy-preserving breach-notification service and change any password known to be compromised.

Password strength score formula

The base score gives increasing credit for length: short entries receive little credit, while passwords of 16, 20 and 24 or more characters receive progressively more. It adds points when lowercase letters, uppercase letters, numbers and symbols are present. Penalties apply to obvious sequences such as 1234 or abcd, keyboard walks such as qwerty, repeated characters, years and a small set of extremely common passwords.

Estimated entropy uses H = L × log₂(N), where L is length and N is the estimated character pool. The displayed entropy is reduced when predictable patterns appear. This helps illustrate why an apparently complex but patterned password can be weaker than a longer randomly generated one.

Worked examples

A short entry such as “Password1” mixes letter cases and a number, but it follows a widely known pattern and receives strong penalties. A longer randomly generated value using several character types generally receives a much higher score. A multi-word passphrase can also score well when the words were selected randomly and the total length is substantial.

What makes a password stronger?

Length, uniqueness and unpredictability are the most important practical qualities. Use a different password for each account so that one data breach does not expose other services. Prefer a password manager to create and store long random credentials. Where available, enable multi-factor authentication, passkeys or a hardware security key.

Limitations of strength meters

No client-side meter can know every cracking strategy, leaked-password list or service-specific defense. An attacker may exploit personal details, reused credentials or an insecure recovery process. The score should guide improvements, not certify safety. A password with a high score can still be unsafe if it has been reused or exposed.

Safe handling and downloads

The report downloads intentionally exclude the entered password. They contain only the score, entropy estimate, length, number of character sets and improvement notes. Do not place real passwords in spreadsheets, screenshots, emails or unencrypted notes. Clear the input after reviewing the result.

Review current recommendations in the NIST Digital Identity Guidelines. Requirements vary by service, and organizations may apply additional controls.

Frequently asked questions

Is my password uploaded?

No. The calculator runs locally in your browser. It does not submit the entered value to HomeCalculation.

Is entropy the same as cracking time?

No. Cracking time depends on the attack method, available hardware, password storage algorithm, rate limits and patterns. Entropy is a simplified estimate.

Why does a common word score poorly?

Attackers test common passwords, words and substitutions early. Adding a digit to a predictable word usually provides less protection than a long random value.

Should I test my real password?

The tool is designed for local processing, but a safe sample with similar structure is the most cautious choice. Never share an active password with another person.

What score should I target?

Aim for a strong or very strong result, then also confirm the password is unique, not exposed and protected by multi-factor authentication where possible.