# Password strength: what actually matters (and a browser-only checker)

> Most online strength meters lie. Here is what actually determines password strength and a client-side checker that gives you the real number.

Author: Nimoy Burrowes (https://nimoyburrowes.com/about)
Category: Guides
Published: 2026-07-19T05:00:00.000Z
Updated: 2026-07-22T04:41:28.015Z
Canonical: https://nimoyburrowes.com/blog/password-strength-what-actually-matters

---

Most password strength meters are junk. They light up green when you add an exclamation mark and act like `Passw0rd!` is safe. It is not. That specific password gets cracked in under a second by any modern GPU running a dictionary attack.

I built a proper one. It runs zxcvbn, the same library your password manager uses, and it runs entirely in your browser. Nothing you type ever leaves the tab.

**Why adding a symbol does not help**

Password strength lives in bits of entropy. Every extra bit doubles the attacker's work. Adding a symbol class to an eight-character password adds around five bits. Adding two more characters of length adds twelve bits. Length wins.

The one exception is when the site caps password length. Then character classes matter because you cannot go longer. If you can hit twenty or more characters, do that first.

**What the checker actually measures**

- A score from 0 (very weak) to 4 (very strong). Based on zxcvbn's guess estimation. It knows common passwords, dictionaries, keyboard walks, dates, and leetspeak.- Entropy in bits.- Estimated crack time against an offline attack running ten thousand guesses per second. That is the realistic threat model when your password hash leaks.

**The privacy thing**

Everything runs in your browser. Nothing you type is sent to a server. Open DevTools, switch to the Network tab, and start typing. You will not see a request go out.

**Try it**

[nimoyburrowes.com/tools/password-strength-checker](https://nimoyburrowes.com/tools/password-strength-checker). If it saves you from a green checkmark that was lying to you, buy me a coffee.

## Frequently asked questions

### Should I trust an online password strength checker?

Only if it runs entirely in your browser. This one does. Open DevTools, switch to the Network tab, and type a password. You will not see a request go out.

### What score should I aim for?

Four out of four for anything that matters. Three is acceptable for low-stakes accounts. Never accept a zero or one for accounts you actually care about.

### Does adding symbols really not help?

It helps a little. Adding a symbol class to an eight-character password adds about five bits of entropy. Adding two more characters of length adds twelve bits. Length is doing most of the work.

### What is the difference between this checker and the meter on the signup form?

Signup meters are usually rule-based ("has uppercase, has number, is over 8 chars"). This one estimates the actual number of guesses an attacker needs. A signup meter can call a bad password strong; a real estimator will not.

### Should I retype my real password here to test it?

You can. Nothing leaves your browser. If you would rather not, retype a variant with the same length and character mix. You will get a very similar score.