密码强度检测工具

How password strength is measured

Two things matter: length and variety. The number of possible passwords is:

combinations = pool_size ^ length

where pool_size is the number of distinct characters you use. A 12-character password drawn from all 95 printable ASCII characters has far more combinations than an 8-character password using only lowercase letters.

Why length beats complexity

Doubling the length of a password multiplies the attacker's work by the square of the pool size. Adding one more character multiplies it by the pool size. For a 12-character password over 95 characters, adding a second character multiplies the work by 95 — far more than any single symbol substitution.

The practical guidance is to prefer a long passphrase over a short complex password. correct horse battery staple is stronger and easier to remember than P@ssw0rd1.

How long does a password survive?

The estimates here assume an offline attack at 10 billion guesses per second, which is a realistic figure for a well-equipped attacker with GPUs against a fast hash like MD5 or SHA-1.

Against a slow password hash such as bcrypt, the same password lasts vastly longer — that is the entire point of using a slow hash for passwords.

Common weaknesses this detects

• Common words such as password, qwerty or admin
• Keyboard patterns like qwerty or asdfgh
• Repeated characters such as aaaaaa
• Sequential runs such as 123456
• Dates and years, which are trivially guessable
• Single character types, like an all-digit PIN

A note on this tool

Everything runs locally in your browser, so the password you type is never transmitted or logged. That is exactly why you should never paste a password into a website you do not control — a site you did not write could be logging it. This one has no server to log it to.

If you need a strong password, use the password generator, which uses crypto.getRandomValues().