Password Strength Checker: What Makes a Password Actually Strong
Password strength isn't about special characters. It's about entropy — the number of possible combinations an attacker would have to try to crack it by brute force.
How Entropy Works
Entropy = log2(character set size ^ password length)
A 8-character password using lowercase letters only (26 characters):
log2(26^8) = 8 × log2(26) ≈ 37.6 bits of entropy
Same length with uppercase, lowercase, numbers, and symbols (~94 characters):
log2(94^8) ≈ 52.4 bits of entropy
A 16-character lowercase-only password:
log2(26^16) ≈ 75.3 bits of entropy
The 16-character simple password is dramatically stronger than the 8-character complex one, even though it looks "simpler."
Why Length Beats Complexity
Adding one character to a password multiplies the search space by the size of the character set. Adding special characters to the rules increases the character set by perhaps 30 characters — multiplying the space by ~1.3x per character used.
Going from 8 to 16 characters multiplies the search space by 26^8 ≈ 200 billion times (for a lowercase-only password). No addition of special characters gets close to that improvement.
The Passphrase Approach
Four random common words: "correct horse battery staple" (the famous XKCD example).
Assuming a 2,000-word common word list: log2(2000^4) ≈ 43.9 bits of entropy — comparable to a random 8-character password with full character set, and far easier to remember.
With a larger dictionary (10,000 words): log2(10000^4) ≈ 53.2 bits — and it's still memorable.
What Actually Gets Passwords Cracked
Modern attackers rarely brute-force character combinations. They use:
- Breached databases — your password from a past leak
- Dictionary attacks — common words, names, dates, common substitutions (@ for a, 0 for o)
- Password patterns — "Word+Year+!" is not random
A unique, randomly generated password (via a password manager) for each site defeats all three.
[Check your password strength →](https://doesitaddup.com)
Frequently Asked Questions
Why does the calculator say my 12-character password with numbers and symbols is weaker than a 16-character lowercase one?
Because entropy depends exponentially on length, not character variety. A 16-character lowercase password has log2(26^16) ≈ 75.3 bits of entropy, while a 12-character password with uppercase, numbers, and symbols has only about 59 bits. Each additional character multiplies the search space by 26+ times; adding special characters only multiplies it by ~1.3x per character used.
Can I use the entropy formula myself to check if my password is strong enough?
Yes—use Entropy = log2(character set size ^ password length). Count your character set (26 for lowercase, 52 for lowercase+uppercase, 94 for full ASCII symbols) and your password length, then calculate. Most people find 50+ bits of entropy sufficient for personal accounts, while 75+ bits is ideal for sensitive accounts like email or banking.
Does this calculator check if my password has been in a data breach?
This calculator measures entropy and theoretical strength only—it does not check against breach databases. For that, use haveibeenpwned.com or your password manager's breach monitoring feature. A password can have high entropy but still be compromised if it was used elsewhere; that's why the calculator emphasizes using unique, randomly generated passwords for each site.
Why does the calculator recommend passphrases like 'correct horse battery staple' over complex passwords?
Four random common words from a 10,000-word dictionary generate about 53.2 bits of entropy—as strong as most 8-character complex passwords—but are far easier to remember and type correctly. They're resistant to dictionary and pattern attacks as long as the words are genuinely random and not predictable phrases, which is why this approach beats forced complexity rules.
This article is for informational purposes only. See our disclaimer.