"Use a strong password" is advice nobody defines. Strong against what? A bored coworker? A phishing site? An offline GPU crack of a leaked database? The answer changes what "strong" means — and that's exactly what a good password evaluator models.
The Password Strength tool computes entropy, estimates crack times for fast and slow hashes, and flags predictable patterns. Here's the model behind it.
Entropy: the actual math
Entropy measures the uncertainty of a password in bits: length × log₂(charset size). A 12-character password from a 95-character keyboard set has:
12 × log₂(95) ≈ 12 × 6.57 ≈ 78.8 bits
Every bit doubles the attacker's work. 40 bits is crackable in hours on a GPU; 60 bits is years for a fast hash; 80+ bits is effectively untouchable offline — and no online attacker will ever get there.
But charset math assumes random characters. Real passwords aren't random, which is why raw length-based formulas overestimate. That's the second half of the model.
Patterns: the penalty box
Pattern-aware crackers (hashcat, John, and every professional tool) don't brute-force characters — they combine masks, dictionaries, and mangling rules: dictionary words, a→4 / o→0 substitutions, keyboard runs (qwerty, 1qaz2wsx), repeated characters, dates, and sequences. The evaluator detects the common ones:
Tr0ub4dor&3— dictionary word + substitutions + digit/symbol decoration. Looks strong, cracks in seconds against a leaked hash database.qwerty123456— keyboard run + sequence. Cracked instantly.correct horse battery staple— four common words. ~44 bits with a known wordlist (still decent!) — but only if the words aren't on the top-10,000 list.
Crack time: two numbers, two threats
The tool reports two estimates:
- Fast hash (1e10 guesses/sec): the "leaked database" threat. If your password falls to this in less than a day, change it.
- bcrypt/argon2 (100 guesses/sec): the "properly hashed service" threat. This is the realistic one for a well-run platform — and why 20 characters of entropy beats 40 characters of hope.
What the score means
The tool returns a 0–4 score plus feedback. Treat it like a linter, not a verdict:
- Score 0–1: change immediately; it's on common lists or trivial patterns.
- Score 2: fine for throwaway accounts, weak for email/banking.
- Score 3: solid for most services — this is the practical target.
- Score 4: strong anywhere; use this for password managers and primary email.
The practical recipe
- Use a password manager; generate 16+ random characters.
- For accounts you type often: a 4–5 word passphrase with uncommon words.
- Never reuse: one breach reuses itself across every account.
- Turn on 2FA for anything the password protects. A great password with no 2FA is weaker than a mediocre password with 2FA.
curl -X POST https://yas.sh/api/v1/tools/password-strength -d '{"input":"Tr0ub4dor&3"}'
The tool won't make you choose better passwords — but it'll tell you the truth about the ones you have, and that's the first step. Strong passwords are a habit, not a character count.
Entropy: what the number actually means
Password strength is not about how "complex" a password looks — it is about entropy, measured in bits. Entropy is a function of how many possible passwords an attacker must guess: each independent bit of entropy doubles the search space. A random 4-character password drawn from 95 characters has about 26 bits; a random 12-character one has about 79 bits. The jump is exponential, which is why length so dramatically outclasses clever symbols. A long, random passphrase (four or five unrelated words) typically lands in the 40–60 bit range and is far harder to crack than a short "complex" password like Tr0ub4dor&3, which attackers' dictionaries and rule-based guessing already anticipate.
The real threats: guessing, dictionaries, and reuse
Understanding what actually breaks passwords helps you choose them well:
- Brute force scales with entropy — long random inputs are effectively immune.
- Dictionary and rule-based attacks break passwords built from real words, names, dates, and common substitutions (
a→@,o→0). This is why "complex" but guessable passwords fail. - Reuse is the killer. A password leaked in one breach is immediately tried against every other account the person owns. Breach databases feed this directly.
This is why the practical rules are length, randomness, and uniqueness — not mandatory symbols. A long unique random password defeats brute force, dictionary attacks, and the reuse problem at once.
What the strength tool measures
When you run the strength check on a password, the tool evaluates the input against these realities: it estimates the effective entropy, flags patterns and dictionary-like structures that dramatically lower real-world strength, and tells you how the password would fare under typical guessing strategies. It will not make you choose a better password, but it tells you the truth about the ones you have — and that truthful signal is the first step toward fixing your weakest accounts.
Building the habit that sticks
Strong passwords are a habit, not a character count, and the habit is easier to maintain than people expect. Use a password manager to generate and store unique, long passwords for every account, and protect the vault with a single long passphrase plus two-factor authentication. Reserve mental memorization for that one master passphrase and any few accounts you genuinely need off the top of your head. When each site gets a unique, long, random password, the "reuse" vulnerability disappears and the manager removes the burden of remembering them. This connects to the password security guide for the broader, practical account-hygiene picture.
The bottom line: length and randomness beat apparent complexity, and uniqueness across accounts beats everything. Let a password manager generate and store long unique passwords, and protect it with a strong passphrase and two-factor authentication.
A practical audit
Run the strength check on your most important accounts first — email, bank, cloud storage — and fix the weakest. For each, move to a long unique password stored in your manager and enable two-factor authentication. Revisiting this shortlist quarterly keeps your highest-value accounts strong without trying to overhaul every login at once.
Conclusion
This guide covered the practical essentials of password strength entropy guide. Apply the discipline, test before relying on it, and revisit when your needs change.