Most password strength meters are junk. They light up green when you add an exclamation mark and act like `Passw0rd!` is safe. It is not. That specific password gets cracked in under a second by any modern GPU running a dictionary attack.
I built a proper one. It runs zxcvbn, the same library your password manager uses, and it runs entirely in your browser. Nothing you type ever leaves the tab.
Why adding a symbol does not help
Password strength lives in bits of entropy. Every extra bit doubles the attacker's work. Adding a symbol class to an eight-character password adds around five bits. Adding two more characters of length adds twelve bits. Length wins.
The one exception is when the site caps password length. Then character classes matter because you cannot go longer. If you can hit twenty or more characters, do that first.
What the checker actually measures
- A score from 0 (very weak) to 4 (very strong). Based on zxcvbn's guess estimation. It knows common passwords, dictionaries, keyboard walks, dates, and leetspeak.
- Entropy in bits.
- Estimated crack time against an offline attack running ten thousand guesses per second. That is the realistic threat model when your password hash leaks.
The privacy thing
Everything runs in your browser. Nothing you type is sent to a server. Open DevTools, switch to the Network tab, and start typing. You will not see a request go out.
Try it
nimoyburrowes.com/tools/password-strength-checker. If it saves you from a green checkmark that was lying to you, buy me a coffee.
