Passwords remain the primary authentication mechanism for the vast majority of online accounts, despite years of predictions about their demise. While passkeys and biometric authentication are gaining ground, passwords are still the front line of defense for everything from email accounts to banking portals. Yet studies consistently show that users choose weak passwords, reuse them across multiple accounts, and rarely check whether their passwords are actually strong enough to resist modern attacks. For users in the United States and European Union, where data breaches are increasingly common and regulations like GDPR and CCPA impose strict requirements on data protection, understanding password strength is not just good practice — it is a critical security skill. In this guide, we explore how password strength is measured, what makes a password truly strong, and how to check your passwords safely.
What Is Password Strength?
Password strength is a measure of how resistant a password is to guessing or brute-force attacks. A strong password is one that would take an impractically long time to crack, even with powerful computing resources. A weak password is one that can be guessed or cracked in seconds or minutes.
Strength is primarily determined by two factors: length and complexity. Length refers to the number of characters in the password, and complexity refers to the variety of character types used (uppercase, lowercase, digits, symbols). However, length is far more important than complexity — a 16-character password using only lowercase letters is significantly stronger than an 8-character password using all character types. This is because each additional character multiplies the number of possible combinations exponentially.
Another critical factor is unpredictability. A password that uses dictionary words, common patterns (like "Password123!"), or personal information (names, birthdays, addresses) is weak regardless of length, because attackers use dictionaries and pattern-based attacks before resorting to brute force. A truly strong password is random — or at least appears random to an attacker.
How Strength Is Measured
Password strength is typically measured using the concept of entropy, which quantifies the unpredictability of the password. Entropy is measured in bits, and each bit represents a doubling of the number of possible combinations. A password with 40 bits of entropy has 2 to the power of 40 (approximately 1 trillion) possible combinations. A password with 60 bits of entropy has 2 to the power of 60 (approximately 1 quintillion) combinations.
The entropy of a password depends on the character set size and the length. If a password uses only lowercase letters (26 characters), each character contributes approximately 4.7 bits of entropy. If it uses uppercase, lowercase, digits, and common symbols (approximately 95 characters), each character contributes approximately 6.5 bits. A 12-character password with all character types has approximately 78 bits of entropy, while a 12-character password with only lowercase letters has approximately 56 bits.
However, this calculation assumes the password is truly random. If the password uses dictionary words or patterns, the effective entropy is much lower because the attacker's search space is reduced. A password like "CorrectHorseBatteryStaple" is 25 characters long but consists of four dictionary words, so its effective entropy is much lower than a random 25-character string. This is why strength checkers look for dictionary words and patterns in addition to calculating raw entropy.
Understanding Password Entropy
To understand why entropy matters, consider how long it takes to crack passwords of different strengths. Modern GPUs can attempt billions of password guesses per second. At 1 billion guesses per second:
- A 28-bit entropy password (e.g., 6 random lowercase letters) is cracked in under a second.
- A 40-bit entropy password is cracked in about 18 minutes.
- A 56-bit entropy password is cracked in about 2 years.
- A 78-bit entropy password would take millions of years to crack.
This illustrates the exponential nature of password strength. Each additional bit of entropy doubles the cracking time. This is why length is so important — adding just a few random characters to a password increases its strength dramatically.
The commonly cited threshold for a "strong" password is 60 bits of entropy, which would take approximately 2 years to crack at 1 billion guesses per second. For truly sensitive accounts (banking, email, password manager master password), aim for 80 bits or more. A 16-character random password using all character types provides approximately 104 bits of entropy, which is effectively uncrackable by brute force with current technology.
Common Password Attacks
Understanding how passwords are attacked helps you understand why certain passwords are weak. There are several common attack methods, each targeting different weaknesses.
Brute Force
A brute force attack tries every possible combination of characters until the correct password is found. Short passwords and passwords with small character sets are most vulnerable. A 6-character lowercase password has only 308 million combinations, which can be tried in under a second with modern hardware. Longer passwords with larger character sets are resistant to brute force.
Dictionary Attacks
A dictionary attack tries words from a dictionary, common passwords, and variations (capitalizing, adding numbers, substituting symbols). Passwords that contain dictionary words, even with modifications, are vulnerable. For example, "P@ssw0rd1!" would be found quickly by a dictionary attack because it is a common word with standard substitutions.
Credential Stuffing
Credential stuffing uses usernames and passwords leaked from one breach to try to log in to other services. If you reuse passwords across accounts, a breach at one service exposes all your accounts. This is why using unique passwords for every account is critical. Password managers make this practical by generating and storing unique passwords.
Phishing
Phishing attacks trick users into entering their passwords on fake websites. No password strength can protect against phishing — the user voluntarily gives the password to the attacker. This is why two-factor authentication (2FA) is essential: even if an attacker obtains your password, they cannot log in without the second factor.
How to Check Password Strength
Checking password strength before using a password is a good security habit. The Automarkly Password Strength Checker analyzes your password in real time and provides a strength rating based on entropy calculation, pattern detection, and dictionary word checking. Critically, the tool processes your password entirely in your browser — it is never sent to any server, never stored, and never logged. This is the safest way to check password strength.
When using a password strength checker, look for the following indicators: the estimated entropy in bits (higher is better), the estimated crack time (how long it would take to crack with current hardware), and any warnings about dictionary words, patterns, or common passwords. A good checker will tell you not just whether the password is strong, but why it is strong or weak, so you can learn what makes a good password.
Never enter your actual passwords into an online tool that sends data to a server. Even if the tool claims to be secure, you have no way to verify that your password is not being logged. Browser-based tools that use client-side JavaScript, like the Automarkly checker, are the only safe option for checking real passwords. For generating new passwords, use the Password Generator, which creates cryptographically random passwords using the Web Crypto API.
Best Practices for Strong Passwords
First, use a password manager. This is the single most effective step you can take. A password manager generates strong, unique passwords for every account and stores them encrypted. You only need to remember one strong master password. Popular options include Bitwarden, 1Password, and KeePass — all of which are available in both the US and EU.
Second, aim for length over complexity. A 16-character password of random lowercase letters is stronger than an 8-character password with all character types. If you need a memorable password, use a passphrase — a sequence of 4 to 6 random words, like "purple-elephant- kitchen-river." This provides high entropy while being easier to remember than a random string of characters.
Third, never reuse passwords. Each account should have a unique password. If one service is breached, your other accounts remain secure. A password manager makes this practical — you never need to remember individual passwords, so there is no reason to reuse them.
Fourth, enable two-factor authentication (2FA) wherever it is available. 2FA adds a second verification step (typically a code from an app or a hardware key) that is required in addition to the password. Even if your password is compromised, the attacker cannot log in without the second factor. Use an authenticator app (like Google Authenticator or Authy) or a hardware key (like YubiKey) rather than SMS-based 2FA, which is vulnerable to SIM swapping.
US and EU Password Regulations
In the United States, the National Institute of Standards and Technology (NIST) publishes password guidelines in Special Publication 800-63B. The current guidelines (updated in 2024) recommend: a minimum password length of 8 characters (with 15+ recommended), acceptance of all printable ASCII characters and Unicode characters, checking passwords against known breached password lists, and no forced periodic password changes. These guidelines represent the current best practices for password security and are followed by US government agencies and increasingly by private sector organizations.
In the European Union, the General Data Protection Regulation (GDPR) requires organizations to implement "appropriate technical and organizational measures" to protect personal data, which includes implementing strong password policies. The European Union Agency for Cybersecurity (ENISA) publishes guidelines that align with NIST recommendations, emphasizing length over complexity and recommending against forced password changes.
In the UK, the National Cyber Security Centre (NCSC) recommends using three random words as a password strategy for accounts that do not require high security, and using password managers with generated passwords for sensitive accounts. The NCSC also recommends against forced password changes and in favor of checking passwords against breach lists.
For organizations in both the US and EU, implementing these guidelines requires providing users with tools to generate and check strong passwords. Browser-based tools like the Password Generator and Password Strength Checker provide these capabilities without requiring users to install additional software or send their passwords to a server.
Password strength is one of the most important aspects of personal and organizational security. By understanding how strength is measured, following current best practices, and using the right tools, you can create passwords that resist modern attacks. Check your passwords with the free Password Strength Checker and generate new ones with the Password Generator — both run entirely in your browser with zero data uploads.