How password strength is measured
Password entropy measures how unpredictable a password is, in bits. A password chosen randomly from a set of N characters has log2(N) bits of entropy per character. A 16-character password from a 95-character set (printable ASCII) has about 105 bits of entropy — extremely strong.
Simple entropy calculations don't account for patterns, though. 'Password123!' has high theoretical entropy but is a terrible password because it follows predictable patterns that password crackers specifically target. The zxcvbn algorithm (developed by Dropbox) is the most widely used realistic strength estimator — it checks for dictionary words, common substitutions (@ for a, 3 for e), keyboard patterns (qwerty, 123456), and date patterns.
The Irreva Password Strength Checker uses entropy estimation and pattern detection to give a realistic strength score and explanation of any weaknesses found.
- Very Weak: crackable in seconds (dictionary words, common passwords)
- Weak: crackable in minutes to hours
- Fair: might withstand an online attack, not an offline one
- Strong: would take years of sustained offline cracking
- Very Strong: effectively uncrackable with current computing
What makes a password weak
Dictionary words in any language are weak — password crackers start with full dictionaries. Adding a number at the end doesn't help much: 'password123' is in every cracker's list. Substitutions like '@ for a' or '3 for e' are also well-known and handled automatically by smart crackers.
Keyboard patterns (qwerty, 1qaz2wsx, asdfgh) are very weak — they're among the first things cracking tools try. Repeating characters (aaaaaa) or sequences (123456, abcdef) offer no real security.
Personal information — your name, birthdate, pet's name, city — is especially weak for targeted attacks. An attacker who knows anything about you will try those values first.
Improving a weak password
The most effective improvement is length. Adding four random characters to a weak password does more for security than complex substitutions on a short password.
Use a password generator rather than modifying existing weak passwords. Human-chosen passwords, even when trying to be complex, follow patterns that remain predictable. A random generator doesn't.
If you need a memorable password, use a passphrase of four or more random, unrelated words: 'correct horse battery staple'. This is both memorable and mathematically strong.