How to check password strength: assessment methods and recommendations

Checking password strength is the first step to protecting accounts from being hacked. According to the Verizon DBIR 2024, more than 80% of breaches involve compromised credentials, and the Have I Been Pwned collection contains over 11 billion passwords from public incidents. A weak password can be cracked in seconds by brute force; a strong one can protect an account for years. This article explains how to assess a password, which criteria matter, and how to use password-checking tools. For a quick assessment, use the reChecker password strength checker.

What makes a password strong

Password strength is determined by three factors: length, character variety, and the absence of predictable patterns. The classic rule of “8 characters, letters, numbers, and a special character” is outdated—modern standards (NIST, OWASP) emphasize length.

Length is the main factor

Each additional character multiplies the number of possible combinations. An 8-character password with an alphabet of 95 characters has 95⁸ ≈ 6,6×10¹⁵ possible combinations; 12 characters gives 95¹² ≈ 5,4×10²³. That is a difference of millions of times.

Character variety

The more character types (lowercase letters, uppercase letters, digits, special characters) a password uses, the larger the alphabet and the harder it is to brute-force. A password made only of digits (alphabet size 10) is weaker than one made of letters and digits (62), or the full set of printable ASCII characters (95).

Absence of patterns

Dictionary words, sequences such as 123, qwerty, and substitutions such as o→0 and a→@ are all accounted for by modern cracking tools. Predictable passwords can be cracked in minutes, even if they use a “complex” mix of characters.

Entropy: a measure of unpredictability

Entropy is the number of bits of information needed to describe a password. The formula is log₂(N^L), where N is the alphabet size and L is the password length.

A password consisting of 8 random characters from an alphabet of 95 gives 8×log₂(95) ≈ 52 bits of entropy. About 20 random characters are needed for 128 bits (a cryptographic strength level). Human-created passwords with patterns have much lower effective entropy.

Brute-force speed and cracking time

Brute-force speed depends on the attack scenario:

• Online attack (logging in to a website): 10–100 attempts per second due to rate limiting and CAPTCHA
• Offline attack (using a stolen hash): billions of attempts per second on a GPU
• Dictionary attack: trying dictionary words and rules—thousands of times faster for typical passwords

Modern GPUs can try billions of hashes per second. At 10 billion attempts per second (a typical estimate for an offline attack), cracking times look like this:

Takeaway: A short password is vulnerable regardless of its “complexity.” Use at least 12 characters for ordinary accounts and 16+ for critical accounts (email, bank, password manager master password). Actual brute-force speed depends on the hash function: bcrypt and Argon2 slow down verification, while old MD5 without a salt allows billions of hashes to be tried per second.

Password assessment methods

Password-strength checking services use different approaches:

• Heuristic analysis — checking length, character types, dictionary words, and patterns
• Entropy calculation — an estimate based on alphabet size and length
• Cracking-time estimate — a calculation based on a specified brute-force speed (usually 10⁹–10¹⁰ attempts/s for an offline attack)
• Breach check — comparison with databases of compromised passwords (separate services, such as HIBP)

A good tool accounts for all these factors: not just “does it contain a special character,” but also “does it contain the word password” or “does it contain a sequence like 123.” The reChecker tool checks common patterns, including qwerty, asdf, 123456, password, and similar patterns.

Common password creation mistakes

Dictionary words and templates

Summer2024!, Password123, Iloveyou1 are typical “strong” passwords. A dictionary word + year + special character at the end is a standard pattern. Such passwords can be guessed in minutes using combinations of dictionary words and suffixes.

Personal information

Birth dates, names, pet names, and city names are all easy to find on social media. Don’t use anything in a password that could be guessed or found out.

Short passwords

Even a “complex” password of 8 characters (K9#mX2$p) is vulnerable to offline brute force. Length matters more than variety.

Reuse

Using one password for every service is disastrous in the event of a breach. A breach of just one website can be enough to access all your accounts. According to Google, 65% of users reuse passwords.

Predictable substitutions

P@ssw0rd, adm1n, Secur3—substitutions such as a→@ and o→0, e→3 have long been accounted for in cracking rules. They do not add real entropy.

Breach and hacking statistics

• Have I Been Pwned: over 11 billion passwords in its breach database
• Verizon DBIR 2024: credentials are responsible for 80%+ of successful breaches
• SplashData: the year's top weak passwords—123456, password, 12345678, qwerty, 123456789
• Google: 65% of users reuse passwords; 24% use variations of the same password

Breaches happen constantly. Passwords from breached databases end up in rainbow tables and cracking dictionaries. Check for compromise with Have I Been Pwned — the service uses k-anonymity, so the full password is not transmitted.

Check password strength with reChecker

The reChecker password strength checker assesses a password against several criteria and shows the approximate time it would take to crack by brute force.

How the tool works

1. Enter a password — paste or type a password into the field
2. Instant assessment — the analysis runs in your browser; the password is not sent to a server
3. Criteria — checks length (8 and 12 characters), lowercase and uppercase letters, digits, special characters, and the absence of common patterns
4. Cracking time — calculated at a speed of 10 billion attempts per second (offline attack)
5. Recommendations — specific suggestions for improving weak passwords

Benefits

• Privacy — processing takes place entirely in your browser; the password never leaves your device
• Free — no registration or limits
• Easy to understand — a strength scale, a criteria checklist, and comparison examples

Use the tool when creating a new password or before changing the password for a critical service.

The tool shows five strength levels, from “very weak” to “very strong.” Each criterion is marked with a check or a cross, so you can immediately see what to improve. Recommendations at the bottom of the section suggest specific steps: add characters, uppercase letters, or special characters, or remove patterns.

Password managers and 2FA

Checking password strength is only one part of protection. Additional measures include:

Password manager

Store passwords in a password manager (Bitwarden, 1Password, KeePass). One master password unlocks the vault. Generate unique passwords for each service—built-in generators create random passwords with high entropy.

Two-factor authentication (2FA)

2FA adds a second factor: a code from an app (TOTP), a push notification, or a hardware key. Even if a password is exposed, an attacker cannot sign in without the second factor. Enable 2FA for email, banks, cloud services, and admin panels.

Passkeys in 2026

Passkeys (WebAuthn/FIDO2) are authentication using cryptographic keys on a device. Instead of a password, you use a fingerprint or Face ID. They are phishing-resistant: the key is not sent to a server, and a fake website cannot obtain access. They are supported by Google, Microsoft, GitHub, Cloudflare, PayPal, and a growing number of services. By 2026, passkeys had become standard on many major platforms. Use passkeys where available; keep a password as a backup method in case you lose your device or need to recover access.

Practical recommendations

1. At least 12 characters for ordinary accounts, 16+ for critical accounts
2. Random generation — don’t come up with passwords manually
3. Uniqueness — one password per service
4. Check before use — assess the password with the reChecker tool
5. Check for breaches — use Have I Been Pwned for passwords you already use
6. Password manager + 2FA — the foundation of personal cybersecurity

For more on creating passwords, see the strong password guide. For password managers, 2FA, and passkeys, see Password security in 2026.

Frequently asked questions

Is it safe to enter a password into an online checker?

It depends on the service. The reChecker tool processes passwords entirely in your browser—the data is not sent to a server. The code runs locally. To be extra cautious, you can check only test passwords with a structure similar to your real password, rather than the password itself.

How many characters are enough for a strong password?

At least 12 characters with a mix of character types (letters, digits, special characters) for ordinary accounts. For critical accounts (email, bank, password manager master password), use 16 or more. Length matters more than “complexity”: 20 letters and digits are stronger than 10 characters with special characters.

Why is a “complex” password still weak?

“Complexity” often means only that a password contains different character types. But a short password (K9#mX2$p–8 characters) can be brute-forced in seconds. Dictionary words with letter substitutions (P@ssw0rd) can be guessed using a dictionary attack. Strength = length + randomness + absence of patterns.

Should I change my password regularly?

NIST and OWASP do not recommend mandatory password changes without a reason. Changing a password every 90 days leads to weaker passwords—users add suffixes (Password1, Password2). Change your password if you suspect it has been compromised, after a service breach, or if you reused it on a hacked website.

How can I check whether my password has appeared in a breach?

Have I Been Pwned lets you check a password using k-anonymity: only the hash prefix is sent, and the full password is not sent to the server. Password managers (1Password Watchtower, Bitwarden) include built-in checks for compromised saved passwords.