Password strength checker

How to Create a Strong Password You Can Actually Remember

Length matters most, but length alone is not enough. A 20 character password made up of ordinary words (mydogfirstbirthday) has far less real entropy than the character count suggests, because an attacker does not guess letter by letter. They try dictionary words and their combinations. That is why a password strength check measures two things: how long the password is and how predictable it is.

A practical approach for most people is the passphrase: four to six randomly chosen words joined by a separator or a number, for example coffee-mountain-7-keyboard. A phrase like this is long, easier to remember than a random string of characters, and resistant to dictionary attacks if the words are truly random rather than connected in meaning.

If you are creating a password manually, keep the following in mind:

1. Aim for at least 16 characters for important accounts (email, banking, password manager).
2. Avoid personal data: names, birth dates, pet names, company names.
3. Do not use patterns like Password2024! or Qwerty123; cracking tools have them at the top of their lists.
4. Do not recycle the same password across multiple sites, because one leak then exposes every account.
5. Use a generator for random passwords and a password manager to remember them.

Why a Long Password Can Be Rated Weak

This is the most common confusion. The password London2023London has 16 characters, but it consists of a known word, a year, and a repetition. Estimates suggest such a password would fall in seconds or minutes, because an attacker does not start from zero. They use lists of leaked passwords, dictionaries, letter substitution rules (a to @, o to 0), and the patterns people habitually create.

Entropy is a measure of unpredictability, expressed in bits. Each additional bit doubles the number of attempts needed to crack the password. A random 12 character password mixing upper and lower case letters, numbers, and symbols has around 70 bits of entropy, while a four word phrase may have less, depending on the size of the dictionary the words were chosen from. That is why a check looks at structure, not just length.

Tip for advanced users: if you use a passphrase, choose words from a larger dictionary and add a random number or symbol in an unexpected place, not at the end. Avoid quotes, sayings, and song lyrics, because they also appear in the databases attackers use.

How Accurate Is the Crack Time Estimate

The estimate assumes 10 billion attempts per second, which matches the speed modern graphics cards reach once an attacker gets hold of a stolen password hash. This is a realistic scenario for sites that store passwords as fast hashes (for example old MD5 or SHA1 without a salt). If a site uses slow hashing (bcrypt, Argon2) with a salt, the real cracking speed is many times lower.

So read the estimate as an order of magnitude, not as an exact deadline. If a tool says "average crack time: 3 seconds," it means the password offers practically no protection. If it says "several centuries," that does not mean the password is eternal: if it leaks on a site that stores it poorly, an attacker may crack it faster than the estimate suggests.

The Most Common Mistakes When Checking and Storing Passwords

The first mistake is testing your real password on random websites. This tool runs locally in your browser and the password never leaves your device, but that is not a rule for every similar service. If you are not sure where the data is sent, test a variant of your password, never the original.

The second mistake is relying on the password alone. A long, strong password does not help if the account is compromised through phishing or a leak from another site. Turn on two factor authentication (MFA) wherever it is available, preferably an app or a hardware key rather than SMS.

The third mistake is storing passwords in plain text, in notes or a spreadsheet. A password manager solves both memory and uniqueness: you remember one long master password, and the tool generates all the rest.

If your company has hundreds of accounts and systems, managing passwords and access goes beyond what a single tool can do; in such cases EVI Solutions can help with rolling out a password manager, MFA, and an access policy.