What actually makes a password strong

The job

A signup form rejects your password or you want to sanity-check a new one. The checker reports an entropy-style estimate plus concrete checks.

How the estimate works

Entropy ≈ length × log2 of the character pool — how many tries a brute-force search needs on average. Mixed classes grow the pool, but length grows it faster: a 16-character lowercase passphrase beats an 8-character soup of symbols.

Patterns get penalized: repeated characters, keyboard runs (qwer) and sequences (abcd, 1234) shrink the real search space, and a short list of the most common leaked passwords fails outright regardless of length.

• Under ~35 bits reads as weak; 60+ is strong; 90+ is very strong for typical threats.
• Every meter is an estimate — real attackers start from leaked lists, names, and predictable substitutions (p4ssw0rd fools nobody).

Worked example

Tr0ub4dor&3 looks complex but is built from a word plus predictable swaps — checkers and crackers both see through it. correct-horse-battery-style passphrases of random words reach higher entropy with less to memorize.

Limits

Nothing is transmitted or stored — the password is evaluated in the page itself. The estimate can't know if you reuse it (the biggest real-world risk) or if a site limits length or blocks paste. Prefer unique passwords from a manager, and a second factor where offered.