Type a password into most strength meters and you’ll watch a bar turn from red to green as you add an uppercase letter, then a number, then a symbol. That bar is not measuring how hard your password is to crack. It’s following a checklist someone wrote once, and the checklist has almost nothing to do with how real password cracking actually works. A tool can tell you “P@ssw0rd123!” satisfies every composition rule on the checklist and still be one of the first hundred guesses a real attacker’s dictionary throws at it.
The honest version of this problem has two separate parts, and most tools online only handle one of them. Part one is raw math: given a password’s length and character set, how many total guesses would a brute-force attack need in the worst case, and how long does that take at different attack speeds. Part two is pattern recognition: is this password actually random, or is it a dictionary word with predictable substitutions, because real attackers almost never brute-force randomly. They run dictionaries and known password lists first, and those crack orders of magnitude faster than the raw math suggests.
Check Your Password’s Real Crack Time
Why Composition Rules Are the Wrong Thing to Optimize For
The classic advice, at least one uppercase letter, one number, one symbol, came from a 2003 NIST document written by a manager named Bill Burr, who has since publicly said he regrets most of it. The rule pushed millions of people toward exactly the predictable patterns it was supposed to prevent: capitalize the first letter, add a number at the end, swap a couple of letters for symbols. Attackers have known this for over a decade, and every serious password-cracking wordlist is built around exactly these substitution patterns.
Length matters more than composition, and it isn’t close. Adding one more character to a password multiplies the brute-force keyspace by the size of your character set. Adding one more character type to a fixed-length password barely moves the needle by comparison. A 16-character password using only lowercase letters has a larger keyspace than an 8-character password using the full range of uppercase, lowercase, numbers, and symbols. This is the entire argument behind passphrases like “correct horse battery staple”: four unrelated words strung together are long, memorable, and mathematically much harder to brute-force than a shorter password stuffed with symbol substitutions.
The Part Raw Entropy Math Gets Wrong
A high entropy score doesn’t mean a password is actually strong
“P@ssw0rd123!” scores well on paper: 12 characters, all four character classes present, decent raw entropy. But it’s a dictionary word with the most common substitution pattern in existence, followed by the most common padding pattern in existence. Any real password cracker checks exactly this pattern within the first few seconds of an attack, regardless of what the brute-force math says. The tool above checks for this specifically, flagging dictionary words (even with common leet substitutions undone), keyboard walks like qwerty, sequential runs like abc or 123, and repeated characters, because these patterns get cracked far faster in practice than pure entropy math implies.
This is also why the tool above is intentionally limited: it checks against a small demonstration list of common passwords and patterns, entirely client-side. A production authentication system should check new passwords against something far larger, like the Pwned Passwords list from Have I Been Pwned, which covers hundreds of millions of passwords exposed in real breaches, using a k-anonymity model so the actual password is never transmitted anywhere. If you’re building the password reset or registration flow for a student project, that’s exactly the kind of check worth adding before deployment, and it pairs directly with this PHP registration and password reset debugger if you’re troubleshooting that flow already.
What “Crack Time” Actually Depends On
The estimates in the tool above assume an attacker has to search, on average, half the total possible keyspace before finding a match, which is the standard way to estimate brute-force time. But the actual attack speed varies enormously depending on what the attacker is attacking and how the password is stored on the other end.
| Attack scenario | Approx. guesses/second | What determines this |
|---|---|---|
| Online login form, rate-limited | ~100/hour | Whatever rate limiting or account lockout policy the target site enforces |
| Online login form, no rate limiting | ~1,000/second | Network latency and how forgiving the login endpoint is |
| Offline attack against a slow hash (bcrypt, Argon2, scrypt) | ~10,000/second | These algorithms are deliberately slow and memory-hard by design |
| Offline attack against a fast hash (unsalted MD5/SHA1) with GPU cracking | ~10 billion/second | Fast, unsalted hashes are essentially free to brute-force at scale |
That last row is the one that matters most for anyone building authentication systems, not just anyone choosing a password. The single biggest lever a developer controls isn’t user password strength at all, it’s which hashing algorithm stores those passwords. A weak password hashed with bcrypt can genuinely outlast a stronger-looking password hashed with unsalted MD5, because the hashing algorithm determines how many guesses per second an attacker gets if your database ever leaks. If you’re reviewing an authentication or role-based access system for exactly this kind of gap, this PHP admin panel and authorization debugger covers the access-control side of that same problem.
Practical Guidance, Not Just Theory
For personal accounts, a password manager generating a genuinely random 16-plus character string beats anything a person can reliably memorize, and it sidesteps the entire dictionary-attack problem since random strings aren’t in any dictionary. For passwords you do need to remember, four or five random unrelated words strung together, in the style of Diceware, hit a strong balance of memorability and real entropy, as long as the words are genuinely randomly chosen and not a phrase you’d find in a quote or song lyric.
For developers setting password policies on their own applications, enforcing a minimum length of twelve characters does more real security work than requiring a symbol. Blocking known-breached passwords via an API check does more than requiring a mix of character types. And rate-limiting login attempts matters more than almost anything else on this list, since it closes off the “online unthrottled” row in the table above entirely, regardless of what the user’s password looks like.
FAQ
Is a longer password always stronger than a more complex one?
For brute-force resistance, yes, length has a bigger mathematical impact than character variety. A password that’s genuinely predictable in structure, though, like a dictionary word plus a couple of digits, can be long and still weak, because real attacks target patterns, not just raw length.
Why does the same password show wildly different crack times?
Because crack time depends entirely on how fast the attacker can guess, which depends on the attack scenario. An unsalted, fast hash leaked in a database breach lets an attacker try billions of guesses per second, while a rate-limited login form might only allow a hundred attempts an hour. The password itself doesn’t change, but the realistic threat does.
Are password strength meters on signup forms accurate?
Most are checklist-based rather than math-based, scoring for the presence of character types rather than actual unpredictability. That’s why a checklist-satisfying password like a dictionary word with common substitutions can score “strong” on a typical signup form while being one of the first patterns any real cracking tool tries.
Should I reuse a strong password across multiple sites?
No, regardless of how strong it is mathematically. If any one site storing that password gets breached, and enough sites eventually do, every other account using the same password becomes vulnerable through credential stuffing, which has nothing to do with how hard the password itself is to guess.