“It would take a billion years to crack” sounds reassuring, but the number only means something if you know who is guessing and how fast. This guide explains the idea behind the Password Strength Checker.
Guesses, not letters
An attacker does not try every combination in order. They try the most likely passwords first: leaked ones, common words, names, keyboard patterns like qwerty, dates, and those with small changes such as P@ssw0rd. A password is only as strong as the number of guesses needed to reach it, and a predictable password is reached early.
Five attackers, five speeds
The checker keeps this simple and shows three of them in plain words: someone guessing on a website, a hacker with a stolen password list, and a hacker with a cluster of powerful computers. Here are all five for reference.
- A website that limits tries: about 100 guesses an hour. Even a mediocre password lasts long here.
- A website with no limit: about 10 guesses a second.
- An offline attack on a slow hash such as bcrypt: about 10,000 a second.
- An offline attack on a fast hash such as MD5: about 10 billion a second.
- A large cracking cluster: about a trillion a second.
The last three happen after a data breach, when attackers have the stored hashes and can guess at full speed with no limits. That is why the checker rates passwords against the fast offline attack.
What makes a password last
- Length. Every extra character multiplies the possibilities. Aim for 14 or more random characters, or 5 or more random words.
- Randomness. Pick characters or words with a generator, not by hand. People are predictable.
- No reuse. One leaked password opens every account that shares it.
Make one in seconds with the Password Generator and keep it in a password manager.