🛡️ Password Strength Checker

Each keystroke re-runs six independent tests. The first counts characters and passes at eight or more. The next four look for the presence of at least one character from each of four sets: lowercase letters, uppercase letters, digits from 0 to 9, and special characters such as punctuation and symbols. The sixth compares your password against a curated list of passwords known to be heavily used, and fails if it matches.

The number of rules passed then maps to a score from 0 to 5. Passing all six with a length of at least twelve characters scores 5. Passing all six at a shorter length scores 4. Five of six scores 3, four of six scores 2, and two or three of six scores 1, with zero or one rule passed scoring 0.

Those scores become labels: 0 or 1 reads as Weak, 2 as Medium, 3 as Strong, and 4 or 5 as Very Strong. The meter fills in proportion to the score, so the bar is a picture of the same number. Alongside it, a suggestion is generated for each failing rule, telling you exactly which character type or length requirement to address.

Start with the password Sunshine2024. It is twelve characters long, so the length rule passes. It contains lowercase letters, an uppercase S and the digits 2024, so three more rules pass. It is not on the common-password list, so that passes too. The only failing rule is the special character requirement.

Five of six rules passed gives a score of 3, which displays as Strong with the meter at 60 per cent, and the suggestion points specifically at the missing symbol.

Now change it to Sunshine2024! by adding a single exclamation mark. The password is now thirteen characters, all six rules pass, and the length is at least twelve, so the score jumps to 5. The label becomes Very Strong and the meter fills completely.

For contrast, try abc123. It is six characters, so length fails, there is no uppercase letter and no symbol, and it appears on the common-password list. Only two rules pass, lowercase and digit, which gives a score of 1 and a Weak rating with three separate fixes suggested.

These six checks describe the composition of a password, not how long it would survive a real attack. That distinction matters. A string like P@ssw0rd1 passes every rule here, yet it follows one of the most predictable substitution patterns and appears in the wordlists attackers try first. A checker that counts character types cannot see that.

Length is the factor that does the heavy lifting, because each additional character multiplies the search space. A passphrase of four or five unrelated words is typically far harder to crack than an eight-character string of mixed symbols, and it is much easier to remember. Use the rules here as a floor to clear rather than a target to optimise.

Three caveats are worth stating plainly. The common-password list is curated and finite, so a password it does not recognise is not thereby proven unique. The tool does not check whether a password has appeared in a known data breach, which is a separate and important test. And as a habit, avoid typing a password you currently use into any web page, including this one; test a variation instead, or let a password manager generate something random you never need to type.