Adding a character to a random password buys you log₂(95) = 6.6 bits. Adding a word to a Diceware passphrase buys log₂(7776) = 12.9 bits — almost exactly twice as much, and a word is far easier to remember than a symbol. That is the whole argument, and it is why the advice everyone was given about symbols and digits was backwards.
Entropy measures how many equally likely possibilities a password was drawn from. It is a property of the process that generated it, not of the characters that came out — which is the single thing most strength meters get wrong.
bits = length × log₂(alphabet size) for a randomly generated string, or
bits = words × log₂(list size) for a passphrase. Cracking time is
2^(bits−1) ÷ guesses per second — half the keyspace on average.
The same password takes minutes or millennia depending entirely on who is guessing. A rate limit of ten attempts a second and an offline attack on a fast unsalted hash at 10¹² guesses/second are eleven orders of magnitude apart. Any single number quoted without naming the attacker is theatre.
Eight random characters from a 95-character set is 52.6 bits — about 55 minutes against a fast offline attack. Five Diceware words is 64.6 bits, or 165 days. Six words is 77.5 bits: roughly 3,500 years. The passphrase is easier to remember and about 4,000× harder than the eight random characters.
No. Everything on this page runs in your browser, there is no analytics on the site, and nothing is transmitted, stored or logged. You can check by opening developer tools and watching the network tab, or by disconnecting from the internet — the page keeps working, because it is all local.
Because most meters count character classes rather than guessability. They see a capital, a digit and a symbol and award points. P@ssw0rd! has all three and is among the first few thousand guesses any real attacker makes. Entropy comes from how the password was chosen, and a meter cannot see that.
Almost nothing. Replacing a with @ and o with 0 adds roughly one bit each against an attacker whose wordlist already applies those rules — which every real cracking tool does. You get the illusion of complexity and pay for it in memorability.
Four is enough for anything rate-limited. Five is a sensible floor for an account that matters. Six puts you past what is feasible offline for the foreseeable future. The words must be chosen randomly — picking them yourself collapses the entropy, because people do not pick uniformly.
That the password was generated uniformly at random from the alphabet or wordlist you specified. Anything you type in is scored two ways: an upper bound assuming it was random, and a pattern-aware estimate that recognises dictionary words, keyboard runs, dates and common substitutions. Not modelled: credential stuffing from a breach elsewhere, phishing, keyloggers, password reuse, or any attack that does not involve guessing. Guess rates are order-of-magnitude figures for hardware classes, not benchmarks of any specific system.
No changes to this tool’s own behaviour since the earliest archived release (v1.21). The full history for the site is in the changelog.