Password Strength Checker

Password Best Practices

• Length over complexity: A 16-character password with only lowercase letters has more entropy than a random 8-character password with all character types.
• Unique per site: Never reuse passwords. If one account is breached, all accounts with the same password are compromised.
• Avoid personal info: Names, birthdays, pet names, and addresses are among the first things attackers try.
• No common patterns: Avoid "Password1!", "qwerty", "abc123", and keyboard patterns like "zxcvbn".

The Passphrase Approach

Instead of a complex password like "J#7kQ!9m", consider a passphrase of 4-6 random words:

• "maple-candle-orbit-frozen" (easy to remember, very strong)
• "correct horse battery staple" (the classic XKCD example)

Random word passphrases are both stronger and easier to remember than short complex passwords. The key is using truly random words, not song lyrics or famous quotes.

Password Managers

A password manager is the best way to maintain unique, strong passwords for every account. Recommended options:

• 1Password: User-friendly, family sharing, travel mode
• Bitwarden: Open source, free tier available
• KeePassXC: Fully offline, open source

Enable Two-Factor Authentication

Even a strong password can be stolen in a data breach. Two-factor authentication (2FA) adds a second layer of security. Prefer authenticator apps (like Authy or Google Authenticator) over SMS codes, as SMS can be intercepted via SIM swapping.

Note: This tool provides a rough estimate of password strength. Real-world attack resistance depends on the hashing algorithm used by the service and the attacker's resources.