Password checker

How it works

You paste or type a string. The checker looks at how long it is and which kinds of characters it contains: lowercase, uppercase, digits, and other marks. Some checkers estimate how many guesses that mix would take if every character were chosen independently from those sets. Human phrases are not that process. A long movie title with a year on the end can look “mixed” and still be a guessable story.

A password strength checker is the same job under a longer name. Strength here is the page’s score, not a laboratory proof. Bands such as weak, fair, good, or strong are the page’s labels for its own arithmetic. Another checker can disagree without either display being broken. Compare a candidate to itself after you change it, on the same checker.

Some checkers also look up whether that exact string has appeared in known dumps. That is a leak check, not a strength check. A unique, long, random string can still be burned if it was stolen from a sick computer or a badly stored database. A common word that has never been in a dump is still a poor secret. Read which test you ran.

Where the string should be scored

Prefer a checker that scores in the browser and does not send the string to a server you do not know. A page that ships your candidate across the network so a remote script can grade it has turned a hygiene tool into a new copy of the secret. If the product must talk to a breach list, a well-built lookup hashes the string and asks only with a prefix, so the full password is not the query. If you cannot tell which kind you opened, do not type a live login there. Type a dummy, or use the checker inside a password manager you already trust.

Length: short strings fail first. Mix: more kinds of characters raise a set-size score; a dictionary phrase does not become random by adding one mark. Leak lookup: a separate question from “how mixed is this.”

Reuse: a unique string contains a third-party breach at that third party. A reused phrase does not. The checker cannot see the rest of your life. It does not know that this string is also the Wi-Fi, the email, and the bank. Uniqueness is a habit the score does not measure. A manager that stores a different secret per site is the tool for that habit. The checker is only a glance at one candidate.

What a high score will not fix

It will not fix a site that stores passwords badly. It will not fix a computer that already has a keylogger. It will not fix a fake login page. It will not replace a second factor. It will not remember the string for you. If you can memorize twenty “strong” variants of one phrase, you are still in the reuse business.

A checker that wants your real password in a strange form is not checking strength. It is collecting a sample. Change a leaked password on a machine you trust. Make the new one unique. Store it. Then stop pasting it into every “is this strong” box you meet on the way to lunch. The secret’s job is to stay scarce. A public scoreboard is the opposite of scarce.