Question 1

Is my password sent anywhere?

Accepted Answer

No. The check runs in your browser with zxcvbn-inspired logic. Open DevTools → Network while typing — zero requests. Even so, as a habit: never type your *actual* production password into a random web tool. Test a pattern like it instead.

Question 2

Why does `Tr0ub4dor&3` score badly?

Accepted Answer

Because cracking rigs don't do dumb brute-force anymore — they use dictionaries, common substitution rules (o→0, a→@), and leaked password corpuses. 'Dictionary word + predictable number + symbol' is one of the first patterns tried. Four random words like `correct horse battery staple` is stronger and easier to remember. XKCD was right.

Question 3

What's a good entropy target?

Accepted Answer

60 bits for anything casual, 80+ bits for anything important, 100+ bits if it's protecting money or a secrets vault. Length buys entropy faster than complexity — a 20-character all-lowercase password beats a 10-character password with 'every rule followed' almost every time.

Question 4

Should I just use a password manager instead?

Accepted Answer

Yes. The strongest password is one you don't have to remember because a password manager generated it and fills it for you. Use this tool to check the master password for your manager (the one you *do* have to remember) — that's the one that actually needs to be strong and memorizable.

Question 5

What about passphrases vs passwords?

Accepted Answer

Four or more random words is a great pattern for anything you have to type yourself. Avoid quotes, lyrics, and famous phrases — cracking dictionaries are full of them. Diceware-style (rolling for random words from a list) is the gold standard if you want to do it properly.

Password Strength Checker

What is Password Strength Checker?

Related tools