Frequently Asked Questions

What is the Strength Meter indicator bar?

The Strength Meter is a visual indicator that shows your password's security level at a glance. The bar fills from left to right as password strength increases:

• Red (20% full): Very Weak - Instantly crackable
• Orange (40% full): Weak - A few seconds to crack
• Yellow (60% full): Medium - A few hours to crack
• Light green (80% full): Strong to Very Strong - Years to centuries
• Green (100% full): Extremely Strong to Uncrackable - Millions of years or more

The bar width is determined by your password's entropy (security score) and changes color to match the strength rating shown above it.

What does "Estimated time to crack" mean?

This is an estimate of how long it would take for an attacker to guess your password using brute-force attacks (trying every possible combination).

How it's calculated:

• Based on your password's entropy (bits of security)
• Assumes modern cracking hardware (~100 billion guesses per second)
• Factors in character set size (lowercase, uppercase, numbers, symbols)
• Accounts for detected patterns (repeats, sequences, keyboard walks)

Time ranges:

• Instantly - Less than 1 second (< 35 bits)
• a few seconds - 35-50 bits
• a few hours - 50-65 bits
• a few years - 65-85 bits
• hundreds of years - 85-120 bits
• millions of years - 120-180 bits
• longer than the age of the universe - 180+ bits

Important: This is a theoretical estimate. Real-world cracking time may vary based on the attacker's hardware and resources, whether the password uses common patterns or words, and if the password has been leaked in a data breach.

What is "Estimated entropy"?

Entropy measures the unpredictability or randomness of your password, expressed in bits. Each additional bit doubles the number of guesses an attacker would need.

How we calculate it:

Base entropy = password length × log₂(character set size)

Then we adjust for:

• Pattern penalties (-3 to -8 bits per pattern):
  • Repeated characters (e.g., ####)
  • Repeated sequences (e.g., abab)
  • Keyboard patterns (e.g., qwerty)
  • Consecutive digits/letters (e.g., 123, abc)
• Length bonus (+0.3 bits per character over 20, max +30 bits)
• Unicode bonus (+2 bits per unknown character, max +40 bits)

Why "estimated"?

This is a custom heuristic, not true Shannon entropy, because:

• We don't check against dictionaries (would catch common words)
• We don't detect l33t-speak (e.g., p@55w0rd)
• Pattern penalties are arbitrary weights, not mathematically derived
• No breach database check (common leaked passwords score higher than they should)

Example: password123 might score ~45 bits here, but would be much lower in reality because it's a common pattern. A truly random 16-character password with mixed case, numbers, and symbols: ~95-105 bits.

"This password has been breached" - what does it mean?

This warning means your password (or a very similar variation) was found in the Have I Been Pwned (HIBP) database - a collection of over 10 billion passwords leaked from data breaches.

How the check works:

1. Your password is converted to a SHA-1 hash (a one-way cryptographic fingerprint)
2. Only the first 5 characters of the hash are sent to HIBP's API
3. HIBP returns all passwords starting with those 5 characters (~500-1000 entries)
4. Your browser checks the full hash locally (never sends your full password)
5. If a match is found, you see this warning

Why it's dangerous:

Breached passwords are used in credential stuffing attacks:

• Attackers try the same password across hundreds of sites
• Automated tools can test millions of breached passwords in hours
• If you reuse passwords, one breach = all accounts at risk

What to do:

• Never use a password that shows this warning
• Use a password manager to generate unique passwords for each site
• Enable multi-factor authentication (MFA) wherever possible

"This password is too common and easily guessable" - what does it mean?

This warning means your password matches one of the 10 million most commonly used passwords from real-world data breaches.

Common password examples:

• password, 123456, qwerty
• letmein, monkey, dragon
• password123, abc123, iloveyou
• Simple patterns: 111111, abcdef, qwerty123

Why common passwords are dangerous:

• Dictionary attacks: Attackers try common words first (fastest way to crack)
• Rainbow tables: Pre-computed hash databases include all common passwords
• Human predictability: People use similar patterns, making them easy to guess

Automatic consequences:

• Any password on the common list is automatically rated "Very Weak"
• Even if it has good length or character variety
• Because attackers will try these passwords first

What to do:

• Avoid dictionary words, even with numbers added (password123 is still common)
• Use a password manager's random generator
• Or create a passphrase from 5-6 unrelated words

"Password is too short" - why does length matter?

This warning appears when your password has fewer than 8 characters - the minimum recommended length for any secure password.

Why length is the most important factor:

Password strength grows exponentially with each additional character:

Length	Character Set	Total Combinations	Time to Crack
6 chars	Lowercase only	308 million	Instantly
8 chars	Lowercase only	200 billion	A few hours
10 chars	Lowercase only	141 trillion	A few years
12 chars	Lowercase only	95 quadrillion	Thousands of years

Why short passwords fail even with complexity:

• A7#kL2! (7 chars, mixed) = ~45 bits entropy
• correcthorse (12 chars, lowercase only) = ~68 bits entropy

The longer password wins, even without symbols or numbers.

Recommendations:

• Minimum: 8 characters (absolute floor)
• Better: 12-16 characters
• Best: 16+ characters or 5-6 word passphrases