Why Password Strength Meters Lie: I Tested 10 Checkers

I ran P@ssw0rd2026! through ten password strength checkers on the same afternoon. One told me it would take two million years to crack. A small script I pointed at the same password found it in about 50,000 guesses, faster than you can blink. Both can't be right, and the gap between them is the whole problem with password strength meters.

The short version: a strength meter is only as good as the attack it imagines. Most of the honest ones imagine the attack a real cracker runs. The bad ones imagine an attacker who guesses randomly, which no attacker does. If you want to know whether a checker is worth trusting, that single difference tells you.

The test

I picked P@ssw0rd2026! on purpose. It has 13 characters, upper and lower case, a digit, two symbols and a year. It ticks every box a 2003-era "strong password" rule asks for. It is also one of the most guessable strings a person can type: the word password, dressed up with the swaps (a→@, o→0) that every cracking tool tries first, plus the current year and a ! on the end.

I ran it through ten checkers and recorded exactly what each one showed on 2 November 2026. Here is the spread.

Seven of the ten got it roughly right: weak, crackable, change it. Two got it badly wrong. One sat on the fence. The interesting part isn't the scores, it's why they split, because the ones that agreed with each other are running the same idea under the hood.

What the honest ones do

Six of the seven accurate checkers are built on, or behave like, zxcvbn, the estimator Dropbox published in 2016. RoboForm says so on its own page. Bitwarden, the Australian government's Service Victoria tool and the reference zxcvbn demo return the same warning and the same suggestions word for word, which is the tell that they share an engine, even though each picks a different line of zxcvbn's output for its headline time.

zxcvbn doesn't measure your alphabet. It tries to guess your password the way a cracker would, and reports how many guesses that takes. It carries word lists (common passwords, English words, names), and it knows the tricks: leetspeak substitutions, a capital on the first letter, a year or a short number on the end, keyboard walks like qwerty. For P@ssw0rd2026! it finds the word password under the substitutions, peels them off, adds the year as a cheap suffix, and lands on about 10 million guesses total. Against a password stored with a slow hash like bcrypt, that's roughly 17 minutes. Against a fast hash like MD5, it's a fraction of a second. Its warning is blunt: "This is similar to a commonly used password."

My own Password Strength Checker uses the same approach, and it runs entirely in your browser, so the password you type never leaves your device. It rated the test string Weak, 23 bits, flagged the P@ssw0rd substitution by name, and told me a capital first letter "barely helps." That is the behaviour you want: the meter naming the exact shortcut an attacker would take.

What the dishonest ones do

Now the two that failed. Security.org's tester said P@ssw0rd2026! would take two million years to crack. passwordmeter.com called it "Fair," put it at about 77 bits, and showed crack times stretching past a trillion years for an online attack.

These meters are doing arithmetic, not simulation. The formula is entropy = length × log₂(charset). For a 13-character password drawn from the 95 printable ASCII characters, that's 13 × log₂(95) ≈ 85 bits, an astronomically large number. Then they divide a made-up keyspace by a guess rate and print the result.

The math isn't wrong. It's answering the wrong question. length × log₂(charset) is the strength of a password chosen at random from that alphabet. P@ssw0rd2026! was not chosen at random. It was chosen by a human reaching for the obvious word and the obvious decorations, and an attacker knows that. The charset formula has no concept of "the word password is in here." So it rates the costume instead of the person wearing it, and the costume looks great.

To be fair to passwordmeter.com, it did flag "Contains a date or year" in its pattern notes, so it half-knows. It just doesn't let that knowledge override the headline number. Security.org gave no such hint.

I tried to crack it

The claim "an attacker would find this fast" is easy to assert and worth actually checking, so I wrote a short hybrid dictionary attack and ran it against an MD5 hash of the password. The rules were the ordinary ones any cracker ships with: take a list of the 1,000 most common passwords, apply leetspeak substitutions and an optional capital, then append a year from 1900–2099 and optionally one symbol.

cracked: P@ssw0rd2026! after 50,360 guesses in 0.028 s

Fifty thousand guesses. On a two-core cloud VM, not a cracking rig. The word password sits at rank two in that list, so the moment the script layered the standard substitutions and years onto it, the match fell out almost immediately. The entire ruleset I used, every word times every variation times every year and symbol, is about 88 million candidates. On one RTX 4090 against unsalted MD5 (hashcat 6.2.6 benchmarks it at ~164 billion guesses a second), exhausting all 88 million would take under a thousandth of a second. The two-million-year estimate was off by roughly fourteen orders of magnitude.

That is the practical meaning of a bad strength meter. It isn't a little optimistic. It is wrong by a factor you can't round away.

Why the lie is dangerous

A strength meter is advice, and people act on it. If a meter tells you P@ssw0rd2026! is good for two million years, you stop there and you reuse it. The composition checklist that most of these tools still show, upper, lower, number, symbol, actively points you toward passwords like this one: short, pattern-heavy, and exactly what rule-based attacks are built to catch.

This is also why NIST stopped recommending composition rules. Its guidance (SP 800-63B) now tells services to drop forced complexity and screen passwords against breach and common-password lists instead, because length and unpredictability beat a symbol quota. A meter that rewards the symbol quota is optimising for the thing the standard abandoned. I've written more on where that line sits in the math of entropy and on how long real passwords survive a GPU.

How to tell a good checker from a bad one in ten seconds

You don't need to read the source. Type P@ssw0rd2026!, or any dictionary word with leet swaps and a year, and watch what happens:

• Good sign: it rates the password weak and tells you why ("looks like a common password," "predictable substitutions," "contains a year"). It's simulating the attack.
• Bad sign: it rates the password strong because it's 13 characters with mixed types, or it quotes a crack time in thousands of years. It's counting your alphabet, not your choices.

A second check: type a genuinely random 16-character string and then type four random words. A charset-math meter loves the 16-character string and often calls the four words "weak" because they're all lowercase, which is backwards. A pattern-aware meter rates both as strong, because both actually are.

Where I'd change my mind

zxcvbn isn't perfect, and I don't want to oversell it. Its word lists are mostly English and a few years old, so a password built from current slang, a non-English dictionary, or a very recent breach list can score higher than it should, because the word genuinely isn't in the list the meter carries. It also can't see that you used the same "strong" password on nine other sites, which is the risk that actually gets most people. No strength meter catches reuse; that's what breach checks and a password manager are for.

So the honest framing isn't "trust zxcvbn blindly." It's "a meter that simulates guessing is in the right business, and a meter that counts characters isn't." The first kind can be improved. The second kind is measuring something that was never the question.

If you want one that does it right and keeps your password on your machine, that's exactly what I built mine to do: paste a candidate into the Password Strength Checker to see the specific patterns an attacker would exploit, then let the Password Generator hand you something with no patterns to find.

FAQ

Are password strength checkers accurate?

Some are, some aren't, and the difference is the engine. A checker built on zxcvbn plays out a real guessing attack (dictionary words, leetspeak, keyboard runs, a year on the end) and rates P@ssw0rd2026! as weak. A checker that just multiplies length by character-set size has no idea the word password is inside it, so it reports a huge number. When two checkers disagree wildly, the arithmetic one is almost always the wrong one.

Why does one checker say my password is strong and another says it's weak?

Because they're not measuring the same thing. The charset-math meter scores the alphabet you could have drawn from, so any 13-character string with a capital, a digit and a symbol looks great. The pattern-aware meter scores how predictable your actual string is, so a dictionary word with the usual swaps scores low no matter how long it is. Trust the second kind.

Is it safe to type my real password into an online checker?

Only when the scoring runs entirely in your browser and nothing is sent anywhere. A breach check that sends the first few characters of a hash is fine; sending the password itself is not. If a site doesn't say clearly that it's client-side, test a password with the same shape instead of your real one, or use a checker like mine that states plainly the password never leaves the page.