Password Strength Meter Widget

How it works

The widget computes two figures. The first is the textbook entropy of a randomly generated password: length times log2 of the character pool (lower case, upper case, digits and symbols). That is an upper bound, because people do not choose characters at random. The second is a guessing estimate that looks for the structure attackers exploit - a short built-in list of the most common passwords (also after undoing substitutions such as @ for a and 0 for o), repeated characters and chunks, sequences like abc or 9876, keyboard walks such as qwerty or asdf, and years and dates - and charges only a few bits for each pattern it finds. Words separated by spaces or hyphens are scored as a passphrase, as if each word came from a 7,776-word list. The lower figure is used, short passwords are capped at weak or fair, and time-to-guess is shown as broad bands for three attack speeds.

Method

• Pool = 26 (a-z) + 26 (A-Z) + 10 (0-9) + 33 (symbols and space), + 100 for other characters
• Random-equivalent entropy = length x log2(pool)
• Guessing estimate = cheapest cover of the password by patterns (common password: log2(rank) + 1; sequence: log2(10 or 26) + 1 + log2(length); keyboard walk, repeat, year: a few bits; date: log2(365 x 200)) and plain characters (log2(pool) each)
• Passphrase of n words = n x log2(7,776); estimate = the lowest of the figures
• Levels: under 28 bits very weak, 28-35 weak, 36-59 fair, 60-79 strong, 80+ very strong; under 8 characters at most weak, under 12 at most fair
• Time bands = 2^bits / 2 guesses at 10/s (online), 10,000/s (bcrypt-style) and 10^10/s (fast hash)

Worked examples

Limitations

• The built-in list of common passwords is deliberately short, so it cannot check against breach corpuses the way a server-side blocklist check under NIST SP 800-63B can.
• Assumes the words of a passphrase were picked at random; a well-known phrase or song lyric is far weaker than the score suggests.
• Time-to-guess bands assume fixed attack speeds; real speed depends on how each site stores passwords, which the widget cannot know.

Where publishers use it

• Sign-up and account-security help pages that explain what makes a good password
• IT and security awareness training for staff or students
• Blog posts about password managers and passphrases
• School computing lessons on entropy and brute-force attacks

Questions

Sources

1. NIST SP 800-63B Digital Identity Guidelines - Authentication and Authenticator Management - National Institute of Standards and Technology . Length over composition rules; compare new passwords against a blocklist of common and compromised ones
2. EFF's new wordlists for random passphrases - Electronic Frontier Foundation, 2016 . 7,776-word list (6^5 dice rolls) behind the passphrase estimate

Cite or recommend this tool

If you reference this tool in an article, course or documentation, these formats are ready to copy. They are optional - nothing is added to your site unless you paste it.

A2Z Tools Password Strength Meter
https://a2z.tools/password-entropy-calculator

<a href="https://a2z.tools/password-entropy-calculator">A2Z Tools Password Strength Meter</a>

[A2Z Tools Password Strength Meter](https://a2z.tools/password-entropy-calculator)

Password Strength Meter by A2Z Tools - https://a2z.tools/password-entropy-calculator