How to Check Password Strength - Complete Guide with Scoring Formula & Examples

Password strength refers to the measure of how effectively a password can resist guessing attacks and brute-force cracking attempts. A strong password combines length, character variety, and unpredictability to create a formidable barrier against unauthorized access. In today's digital landscape where data breaches affect millions of users annually, understanding password strength is your first line of defense against identity theft and account compromise.

Password strength matters because weak passwords are responsible for approximately 80% of hacking-related breaches according to Verizon's Data Breach Investigations Report. Attackers use sophisticated tools that can test billions of password combinations per second. A password that takes a human 5 seconds to guess might take a computer just milliseconds, but a strong password could take centuries to crack even with modern computing power.

Real-world applications include securing email accounts, banking portals, social media profiles, and corporate systems. For instance, a password like "Tr0ub4dor&3" might seem complex but is actually vulnerable to dictionary attacks, while "correct horse battery staple" (four random words) provides significantly better protection due to its length and unpredictability.

Password strength is calculated using a multi-factor scoring system that evaluates several key dimensions. The most common methodology combines entropy calculation with pattern detection and dictionary checks.

Base Entropy Formula:

Entropy (bits) = L × log₂(R)

Where L = password length and R = character pool size (26 for lowercase, 52 for letters, 62 for alphanumeric, 94 for all printable characters)

Strength Scoring Breakdown:

• Length (40%): 8 chars = 10pts, 12 chars = 20pts, 16+ chars = 40pts
• Character Variety (30%): Each type adds 7.5pts (lowercase, uppercase, numbers, symbols)
• Unpredictability (20%): -10pts for common patterns (123, abc, qwerty), -15pts for dictionary words
• Unique Characters (10%): Bonus points for high character diversity

Final Score Interpretation:

• 0-20 points: Very Weak (crack time: seconds)
• 21-40 points: Weak (crack time: minutes to hours)
• 41-60 points: Moderate (crack time: days to months)
• 61-80 points: Strong (crack time: years to centuries)
• 81-100 points: Very Strong (crack time: millennia+)

Example 1: "password123"

Length: 11 characters × log₂(62) = ~65 bits base entropy

However, pattern detection finds "password" (common word, -15pts) and "123" (sequential, -10pts)

Character variety: lowercase + numbers = 15pts

Final score: ~25 points (Weak) - Crack time: approximately 3 hours with modern GPU

Example 2: "Tr0ub4dor&3"

Length: 11 characters

Character variety: all 4 types = 30pts

Length bonus: 11 chars = 15pts

Pattern penalty: leet-speak substitution detected (-5pts), dictionary word base (-15pts)

Final score: ~45 points (Moderate) - Crack time: approximately 3 days

Example 3: "X9#mK2$pL7@nQ4!w"

Length: 16 characters × log₂(94) = ~105 bits entropy

Character variety: all 4 types = 30pts

Length bonus: 16+ chars = 40pts

No patterns detected: 0 penalty

Unique characters: 16/16 unique = 10pts bonus

Final score: 95 points (Very Strong) - Crack time: approximately 29,000 years

1. Over-relying on special characters in predictable positions

Adding "!" or "1" at the end of a dictionary word (like "Password1!") provides minimal security improvement. Attackers' dictionaries include these common modifications. Instead, use completely random characters throughout.

2. Confusing complexity with strength

A 12-character password with all character types but containing a dictionary word is weaker than a 20-character passphrase of random words. "MyD0g$Name!Is" scores lower than "purple elephant jumps quietly over clouds" due to length and unpredictability factors.

3. Using personal information

Birthdays (01-31), phone numbers, pet names, and anniversaries are easily discovered through social media and should never be used. A password containing your birthday reduces the effective character pool significantly.

4. Reusing passwords across accounts

Even a strong password becomes weak if reused. One breach exposes all accounts. Use unique passwords for each service.

5. Ignoring length in favor of complexity

Length is the single most important factor. An 18-character password with only lowercase letters (26^18 combinations) is stronger than an 8-character password with all character types (94^8 combinations).