Password Strength Checker: What the Score and Crack Time Mean

The short answer

A password strength checker looks at the length and character types of a password and estimates how long a brute-force attack would take. It is a useful quick test, but it cannot see patterns that real attackers try first, such as a common word with a capital letter, a year and an exclamation mark. Treat a "Strong" score as necessary, not sufficient.

The Password Strength Checker runs entirely in your browser: what you type is analysed locally and is not sent anywhere. For a password that is strong in practice, generate a long random one with the Password Generator and store it in a password manager.

What the Lazyblink checker measures

The checker runs ten pass/fail tests. Each pass adds one point to a score out of 10:

Check	Passes when
8+ characters	Length is at least 8
12+ characters	Length is at least 12
16+ characters	Length is at least 16
Uppercase	Contains A–Z
Lowercase	Contains a–z
Numbers	Contains 0–9
Symbols	Contains anything else, including spaces
Not a common password	Is not one of 10 very common passwords such as "password", "123456" or "qwerty"
No repeated characters	No character appears 3 or more times in a row
No sequences	Does not contain runs like "123", "789" or "abc"

The label follows the score: 0–3 is Weak, 4–6 Fair, 7–8 Good and 9–10 Strong. It also lists suggestions for the checks you failed.

How "Estimated crack time" is calculated

The crack time assumes a brute-force attack: an attacker trying every possible combination at 10 billion guesses per second. The number of combinations depends on which character groups appear (26 lowercase, 26 uppercase, 10 digits, 32 symbols) raised to the power of the length. The result is shown as "Instantly", minutes, hours, days, years or "Centuries".

That model is a fair upper bound for a truly random password. It is far too generous for a human-chosen one, because attackers do not start with random guessing.

Why some weak passwords score well

Real attacks start with lists of leaked passwords, dictionary words and common substitutions, then add predictable endings like years and "!". A brute-force estimate cannot see that. Here is how the checker rates a few examples, calculated with its own rules:

Password	Score	Label	Estimated crack time	Reality
password	4/10	Fair	Instantly	One of the most leaked passwords; guessed at once
Password1	6/10	Fair	16 days	Word + capital + digit; on every cracking list
Password1!	8/10	Good	171 years	Same pattern with "!"; still guessed quickly
P@ssw0rd2026	9/10	Strong	Centuries	Common substitutions + year; predictable
kX9#mQ2$vL	8/10	Good	171 years	Random, 10 characters; genuinely hard to guess
tiger-lamp-orbit-cactus	8/10	Good	Centuries	Four random words; strong if the words were chosen randomly

Notice that P@ssw0rd2026 scores higher than the random kX9#mQ2$vL. The score rewards ticking boxes; it cannot tell that "P@ssw0rd" is just "Password" with swaps every attacker knows.

How to read your result: if the checker says Weak or Fair, the password is definitely weak. If it says Good or Strong, check that the password is also random (made by a generator, or random words picked by dice or software) and unique (not used on any other site).

What current guidance says

The US National Institute of Standards and Technology (NIST) publishes widely followed password rules in SP 800-63B. The current revision, part of SP 800-63-4, says that services:

• Must require at least 15 characters when a password is the only factor used to log in, and at least 8 characters when the password is used with multi-factor authentication.
• Should allow passwords of at least 64 characters, so long passphrases are possible.
• Must not impose other composition rules, such as forcing a mix of uppercase, digits and symbols.
• Must check new passwords against a blocklist of commonly used, expected or compromised passwords.
• Must not force periodic password changes, but must force a change if there is evidence the password has been compromised.

The direction is clear: length and unpredictability matter more than symbol rules. A long random passphrase beats a short password stuffed with symbols. Note that many websites still enforce older composition rules, so you may need to add a symbol or digit to satisfy a specific site.

Best practices that hold up

Use a password manager and let it generate a different random password for each account. You only need to remember one strong master passphrase.

Aim for 15+ characters. For a passphrase, four or more randomly chosen words work well. For a random character password, 16 or more is comfortable.

Never reuse passwords. When one site is breached, attackers try the same email and password on others (credential stuffing). Reuse turns one breach into many.

Turn on two-factor authentication for email, banking and any account that can reset other accounts.

Change a password when there is a reason: a breach notice, suspicious login, or a shared password with someone who no longer needs it.

Do not build passwords from personal facts like names, birthdays, phone numbers or cricket team names. These are easy to find on social media.

Is it safe to type a real password into a checker?

With this checker, the analysis happens in the page's JavaScript and nothing is sent to a server; you can verify this by disconnecting from the internet and seeing that it still works. As a general habit, though, be careful with online checkers you do not trust. A safer approach is to test a password with the same pattern as your real one (same length and character types) rather than the password itself.

Common mistakes

• Taking "Centuries" literally for a password made from a word, a name or a date.
• Making a password "strong" by adding ! or 1 to the end. Attackers try these endings first.
• Using the same strong password everywhere. Strength does not protect against reuse.
• Writing passwords in a notes app or spreadsheet without encryption.

For a deeper guide on building strong passwords, see How to Create an Unbreakable Password.