In this article
What Is Password Strength?
Password strength is a measure of how resistant a password is to being guessed or cracked. It takes into account length, character variety, pattern predictability, and whether the password appears in known breach databases. A strong password is one that would take an attacker an unreasonable amount of time to crack with current computing power.
The most common password security failures are: using short passwords, using dictionary words, using personal information, using keyboard patterns like qwerty or 12345, and reusing passwords across multiple services.
How Password Strength Is Measured
CheckTown's password checker evaluates multiple dimensions to produce a comprehensive strength assessment.
- Length scoring — longer passwords contribute exponentially more entropy; 16+ characters is recommended
- Character diversity — points for using lowercase, uppercase, digits, and special characters
- Pattern detection — reduces score for keyboard walks, repeated characters, and dictionary words
Try it free — no signup required
Check Password Strength →When To Use Password Strength Checking
Password strength checking should be integrated into any system where users create passwords.
- User registration — show real-time strength feedback as users type to encourage stronger passwords
- Password reset flows — enforce minimum strength requirements on new passwords to prevent immediate re-use of weak passwords
- Security audits — check existing stored password hashes against strength criteria to identify accounts requiring forced reset
Frequently Asked Questions
What makes a password truly strong?
The most important factor is length — every additional character multiplies the number of possible combinations. A randomly generated 20-character password using mixed character types is exponentially stronger than a memorable 8-character password. Using a password manager to generate and store random passwords is the best practice.
Should I enforce complexity rules like requiring uppercase and special characters?
Modern security guidance (NIST SP 800-63B) recommends against rigid complexity rules in favor of length requirements. Complexity rules often lead users to predictable substitutions (p@ssw0rd) that are easy to crack. Instead, focus on minimum length, breach database checks, and blocking common passwords.
What is entropy and how does it relate to password strength?
Password entropy measures unpredictability in bits. A password with 64 bits of entropy has 2^64 possible combinations. Each bit doubles the search space for an attacker. Length contributes the most entropy; a 4-word passphrase can exceed the entropy of a complex 8-character password.