What a strong password actually measures

This guide explains what the numbers mean, where they break down, and what actually protects you. It also documents exactly what our Password Generator and Password Strength Test compute, because a strength meter you can't audit is a mood ring.

What does "strong password" actually measure?

Entropy, in bits. If a password is drawn uniformly at random from N equally likely possibilities, its entropy is log2(N). Each extra bit doubles the search space. A random 4-digit PIN has log2(10,000) ≈ 13.3 bits. A 20-character password drawn from an 87-character alphabet has 20 × log2(87) ≈ 129 bits.

The catch sits in the phrase "drawn uniformly at random." Character-set math only describes passwords a machine picked. When a human picks Vilnius2026!, the alphabet math says 12 characters from 87 symbols, about 77 bits. The real search space is a city name, a year, and a trailing exclamation mark, and cracking tools guess exactly those shapes first. Real attackers guess in frequency order: leaked-password lists, dictionary words, names, dates, keyboard walks, then mutations of all of the above. This is the core insight behind zxcvbn, Dropbox's strength estimator: model the guesser, not the alphabet, because "Password1!" satisfies every complexity rule and falls within the first few thousand guesses.

So one honest rule covers it. Entropy math applies to generated secrets; human-chosen passwords have less entropy than the character math suggests, usually far less. Our generator can print "129 bits" and mean it because the machine chose every character with crypto.getRandomValues. A checker looking at a password you typed can only report a ceiling.

How long does cracking really take?

There is no single answer, because "cracking" means different things in different places.

An online attack guesses through the site's login form. Any competent service throttles this to a crawl, which is why our strength test's online scenario assumes 100 guesses per second.

An offline attack happens after a breach, when the attacker holds the database of password hashes and guesses on their own hardware. Here the deciding factor is not your password. It is which hash function the site used, and the spread is enormous. On a single RTX 5090, hashcat benchmarks around 220 billion MD5 guesses per second, but roughly 305,000 per second against bcrypt at hashcat's benchmark cost factor of 5, which works out to roughly 2,400 per second at a realistic cost factor of 12. That is a gap of about eight orders of magnitude on identical hardware. The hash function is the story.

You never know which hash a site uses, so any single crack-time figure is fiction. Honest estimates are scenario tables, which is what our strength test shows. Here is the full picture:

Assumptions, stated plainly: times are the average case (half the keyspace searched); a single RTX 5090 at published hashcat benchmark rates; the attacker knows your exact generation method and targets you alone. Real breach attackers run many GPUs but crack whole databases at once, harvesting the weak passwords and rarely bothering with strong individual ones. The "weak human choice" row is illustrative; frequency-ordered guessing often finds real human passwords even faster than 2^28 tries.

Two readings of that table matter. First, at 60 bits, MD5 falls in a month while bcrypt holds for geological time, with the password identical in both rows. Second, from about 77 bits up, even the worst-case hash holds for centuries. A generated password in the 90-plus range is not the weak link in any realistic scenario, which is why our generator labels that range "excellent" and stops there rather than inventing higher drama.

Modern password hashes go further than bcrypt. Argon2id, the current recommendation from password-hashing practice, is deliberately memory-hard, so GPUs lose most of their advantage. Even the middling PBKDF2-SHA256 runs around 11 million guesses per second on that same card at 1,000 iterations, twenty-thousandfold slower than MD5. Sites that store passwords well make your side of the job easy.

Why did the 8-characters-with-symbols era die?

Because the evidence came in. NIST's current digital identity guideline, SP 800-63B revision 4 (finalized 2025), reads like an obituary for 2005-era policy. Verifiers SHALL NOT impose composition rules such as requiring mixtures of character types. Verifiers SHALL NOT require periodic password changes, only a forced change on evidence of compromise. Passwords used as a single factor SHALL be at least 15 characters. And verifiers SHALL check candidate passwords against blocklists of known compromised and commonly used passwords.

The reasoning is the zxcvbn insight applied to policy. Composition rules pushed everyone toward the same predictable mutations: capital first, digit and symbol last. Forced 90-day rotation produced Spring2026! followed by Summer2026!, an increment any cracking rig models in one rule. Length and a breach-list check do more than any symbol requirement, because length grows the search space geometrically while composition rules mostly reshuffle a small one.

Do I need to change my passwords regularly?

No. Change a password when there is a reason: the site was breached, the password appeared in a leak, you typed it on a page you now distrust, or you shared it. Scheduled rotation of a strong unique password adds no security and trains people into weak incremental patterns, which is exactly why NIST now prohibits verifiers from demanding it. The useful habit is not rotation but monitoring: breach-notification services tell you when a specific credential actually needs replacing.

Are passphrases better than random strings?

They solve a different problem. Compared at equal entropy, a passphrase is much longer to type and a random string is impossible to remember. Diceware makes the passphrase math exact: EFF's long wordlist has 7,776 words, so each uniformly random word contributes log2(7776) ≈ 12.9 bits, and six words give about 77.5 bits. As the table shows, that survives even a fast-hash breach for millennia. The words must come from dice or a CSPRNG; a phrase you composed yourself inherits the frequency-ordered-guessing problem and lands far below the wordlist math.

The practical split: you memorize one or two secrets in life, the password manager's master password and perhaps your computer login. Make those diceware passphrases. Everything else lives in the manager and never touches your memory, so it should be a generated random string at maximum comfortable length. Memorability is a cost worth paying only for secrets a human must actually recall.

What actually gets accounts hacked?

Mostly not cracking. Verizon's 2026 Data Breach Investigations Report has vulnerability exploitation (31% of initial access) overtaking credential abuse (down to 13%) for the first time in the report's history, with credential abuse still implicated in roughly 39% of breaches across the full attack chain. The credentials being abused come from three places, and password strength is irrelevant to every one of them.

Credential stuffing replays email-and-password pairs from old breaches against other sites. If you reused the password, its strength never mattered; the attacker already has it in plaintext. Phishing captures whatever you type on the fake page, at any length. Infostealer malware lifts saved passwords and session cookies straight from an infected machine; the 2026 DBIR found 73% of ransomware victims had an associated infostealer or credential-leak signal within the year.

A 129-bit password reused on two sites is weaker in practice than a 60-bit password used on one. Uniqueness beats strength, because uniqueness is the property that defuses the most common attack.

So what is the honest hierarchy?

From most to least protective: unique per site, stored in a password manager, with phishing-resistant 2FA (a security key or passkeys) on the accounts that matter, then and only then raw strength. Strength still earns its place as breach insurance, since a strong password stays uncracked even when a site stored it badly, and a generator makes strength free. But it is the fourth line of defense, not the first.

On passkeys: adoption is real and no longer niche. The FIDO Alliance's 2026 figures count around five billion passkeys in use, with 75% of surveyed consumers having enabled one somewhere and about half using them regularly where offered. They resist phishing and stuffing by construction, so turn them on wherever offered. Coverage is still partial across the long tail of sites, which means passkeys are a reason to expect fewer passwords, not a reason to skip the manager that handles the rest.

Fair questions

Is it safe to type a real password into your strength test?

The check runs in this page's memory on your device and the value is gone when you leave. This site makes no network requests that could carry it, and its CSP blocks requests to any other domain outright. Still, the habit of pasting live passwords into any web page is worth avoiding; test candidates, not your actual bank password.

Why does your strength test disagree with other meters?

All character-class meters, ours included, report an upper bound. Ours subtracts penalties for repeats, keyboard sequences, and top-leaked prefixes, and shows two attack scenarios instead of one verdict, but a determined guesser modeling your habits can still beat any estimate. Treat every meter's output as a ceiling.

How long should a generated password be?

For anything stored in a manager, 20 characters with all character sets (about 129 bits) costs you nothing and ends the conversation. If a site caps length, take the maximum it allows.

Are the "skip look-alikes" characters a security loss?

Removing Il1O0 shrinks the alphabet from 87 to 82 characters, which costs about 0.09 bits per character, under 2 bits at 20 characters. If you ever transcribe passwords by eye, take the trade.

The working rules

• Install a password manager and let it generate a unique random password for every account, at 20 characters where sites allow it.
• Protect the manager with a six-word diceware passphrase you generated with dice or a real RNG, not composed.
• Turn on 2FA everywhere it exists, preferring passkeys or security keys over SMS.
• Stop scheduled rotation; replace passwords only on evidence of compromise.
• Kill password reuse first, starting with email, banking, and anything holding a payment method.

Sources and further reading

1. Wheeler, "zxcvbn: Low-Budget Password Strength Estimation" (USENIX Security 2016) — why honest meters model the guesser, not the alphabet.
2. RTX 5090 hashcat benchmarks — the MD5, bcrypt and PBKDF2 rates behind the crack-time table.
3. NIST SP 800-63B revision 4 — the current rules on composition, rotation, minimum length and blocklists.
4. EFF: new wordlists for random passphrases — the 7,776-word diceware list and its per-word entropy.
5. Descope: Verizon DBIR 2026 summary — the initial-access and credential-abuse figures.
6. SpyCloud: 2026 DBIR takeaways — the infostealer and ransomware correlation.
7. FIDO Alliance, World Passkey Day 2026 — the passkey adoption figures.