Strength meters look scientific, but most are estimating one simple quantity: how many guesses an attacker would need. Here is the arithmetic behind the bars, why two meters disagree about the same password, and what the colours never tell you.
A strength meter answers a narrower question than most people assume. It does not know whether your password is good in any absolute sense; it estimates how large the set of possible passwords is, given how the password appears to have been made, and converts that into guesses, time or a row of coloured bars. If the estimate starts from the wrong assumption — for example, that a password was chosen uniformly at random when a human actually picked it — the meter can be wildly optimistic.
That is why the same password can score "excellent" on one site and "weak" on another. The meters are not measuring the password itself. They are measuring a model of how you might have created it, and different models produce different answers. Understanding the model is more useful than trusting the colour.
Key takeaways
- Meters estimate entropy — the size of the search space — not the password's character soup.
- Length adds entropy faster and more predictably than symbol variety does.
- A meter cannot know a password is reused, breached or written on a sticky note.
- Treat crack-time figures as illustrations of scale, never as promises.
Entropy: the one number underneath every bar
Entropy is measured in bits, and each bit doubles the number of possibilities an attacker must search. A password with 40 bits of entropy has about 1.1 trillion possibilities (240); one with 80 bits has about 1.2 × 1024. The formula is simple: entropy = length × log2(pool size). Twenty characters drawn at random from 94 printable characters gives 20 × 6.55 ≈ 131 bits. Eight characters from the same pool gives only about 52 bits, no matter how exotic the symbols look.
The catch is the phrase "drawn at random". The formula describes a machine picking uniformly from a pool. Human choices are not uniform: people favour capital letters at the start, digits at the end, years, names and keyboard walks like qwerty. Attackers know this, and their guessing software tries the human-shaped passwords first — so a human-invented 12-character password usually has far less real entropy than the formula suggests, while a machine-generated one has exactly what the formula says.
How crack time is calculated — and why the guesses-per-second matters
To turn bits into years, a meter divides the search space by an assumed guessing rate. That rate depends entirely on how the password was stored by the service that leaked it. Against a modern, deliberately slow password hash such as bcrypt or Argon2, an attacker might manage thousands of guesses per second per password. Against a fast, unsalted hash such as MD5, a single high-end graphics card can test tens of billions per second.
| Storage the attacker faces | Rough guesses per second | Time to exhaust a 52-bit space |
|---|---|---|
| Argon2 / bcrypt (well tuned) | ~1,000–10,000 | 14,000+ years |
| SHA-256 (fast hash, misused for passwords) | ~10 billion | about 5 days |
| MD5 (fast hash, misused for passwords) | ~100 billion | about 12 hours |
Read the table as a lesson in why meters print such different times: the password did not change, the assumption about its storage did. It is also why a password that is fine for a properly built service can be hopeless for a badly built one — and why you cannot control which kind you are dealing with.
Two families of meters: formula meters and guessing meters
Simple meters just apply rules: a point for length, a point for a symbol, a penalty for a dictionary word. They are fast and predictable, but easy to fool — Password1! ticks every box on a rule-based meter while appearing in every breach wordlist ever compiled. Rule meters reward the appearance of randomness, not the reality of it.
Better meters, such as the zxcvbn library used by several large services, work the other way round: they try to guess the password the way an attacker would, recognising dictionary words, names, dates, repeats, sequences and l33t-style substitutions, then report how many guesses that attack would take. That is a much harder estimate to fool, because it models the enemy instead of the recipe. When you compare meters, a guessing-style estimate is the one worth believing.
Reading a meter without being misled by it
- Ask how the password was made, not how it looks. If a generator produced it at random, the formula estimate is trustworthy. If you invented it, assume the real strength is far lower than any bar suggests.
- Chase length first. Going from 12 to 20 random characters adds about 52 bits — more than any amount of symbol juggling at 12 characters can add.
- Ignore the years, watch the bits. A claim of "1026 years to crack" really means "this search space has roughly 87+ bits under a stated guessing rate". Bits travel between contexts; years do not.
- Remember what no meter sees. Reuse across sites, phishing, malware and breaches are all invisible to a strength estimate. A strong password used everywhere is still one leak away from a bad week.
Mistakes and pitfalls
Trusting the green bar on a human-invented password
The bar measures the recipe it assumes. If you typed a word, a year and an exclamation mark, the effective search space is tiny even if the bar turns green, because attackers try exactly those shapes first, in exactly that order.
Believing symbols compensate for shortness
Swapping a for @ adds almost nothing once attackers include substitution rules in their guessing — which they all do. Two extra random characters add more strength than any amount of leetspeak.
Treating crack time as a guarantee
Crack-time numbers assume a particular hash, a particular hardware budget and an attacker who bothers to search exhaustively. A password can also fall to phishing or reuse in seconds, which no amount of entropy prevents.
Common questions
Why did one site call my password strong and another call it weak?
They used different models. A rule-based meter counted character variety; a guessing-based meter recognised the word and pattern inside it. The pessimistic answer is usually the more honest one for anything a human invented.
How many bits is enough?
For a machine-generated password, 80 bits or more puts exhaustive search out of practical reach for the foreseeable future — that is roughly 13 random characters from the full printable set, or five to six words in a passphrase. More is cheap insurance, since a password manager does the remembering.
Does a meter know if my password has been breached?
No. A strength estimate and a breach check are different tools. A password can be genuinely high-entropy and still be public because it was reused from a leaked service. Uniqueness matters as much as strength.
To wrap up
A strength meter is best read as a calculator, not a judge. Feed it a password that really was produced the way the formula assumes — generated at random, at a decent length, unique to one account — and its estimate becomes meaningful. Feed it a clever human invention and the green bar is mostly decoration.
Try it yourself
The generator on this site shows its working as you use it: length and character pool in, entropy and a plain-language verdict out. Generate a few at different lengths and watch how quickly the bits climb.