"Use a strong password" is advice nobody defines. Strong against what? A bored coworker? A phishing site? An offline GPU crack of a leaked database? The answer changes what "strong" means — and that's exactly what a good password evaluator models.
The Password Strength tool computes entropy, estimates crack times for fast and slow hashes, and flags predictable patterns. Here's the model behind it.
Entropy: the actual math
Entropy measures the uncertainty of a password in bits: length × log₂(charset size). A 12-character password from a 95-character keyboard set has:
12 × log₂(95) ≈ 12 × 6.57 ≈ 78.8 bits
Every bit doubles the attacker's work. 40 bits is crackable in hours on a GPU; 60 bits is years for a fast hash; 80+ bits is effectively untouchable offline — and no online attacker will ever get there.
But charset math assumes random characters. Real passwords aren't random, which is why raw length-based formulas overestimate. That's the second half of the model.
Patterns: the penalty box
Pattern-aware crackers (hashcat, John, and every professional tool) don't brute-force characters — they combine masks, dictionaries, and mangling rules: dictionary words, a→4 / o→0 substitutions, keyboard runs (qwerty, 1qaz2wsx), repeated characters, dates, and sequences. The evaluator detects the common ones:
Tr0ub4dor&3— dictionary word + substitutions + digit/symbol decoration. Looks strong, cracks in seconds against a leaked hash database.qwerty123456— keyboard run + sequence. Cracked instantly.correct horse battery staple— four common words. ~44 bits with a known wordlist (still decent!) — but only if the words aren't on the top-10,000 list.
Crack time: two numbers, two threats
The tool reports two estimates:
- Fast hash (1e10 guesses/sec): the "leaked database" threat. If your password falls to this in less than a day, change it.
- bcrypt/argon2 (100 guesses/sec): the "properly hashed service" threat. This is the realistic one for a well-run platform — and why 20 characters of entropy beats 40 characters of hope.
What the score means
The tool returns a 0–4 score plus feedback. Treat it like a linter, not a verdict:
- Score 0–1: change immediately; it's on common lists or trivial patterns.
- Score 2: fine for throwaway accounts, weak for email/banking.
- Score 3: solid for most services — this is the practical target.
- Score 4: strong anywhere; use this for password managers and primary email.
The practical recipe
- Use a password manager; generate 16+ random characters.
- For accounts you type often: a 4–5 word passphrase with uncommon words.
- Never reuse: one breach reuses itself across every account.
- Turn on 2FA for anything the password protects. A great password with no 2FA is weaker than a mediocre password with 2FA.
curl -X POST https://yas.sh/api/v1/tools/password-strength -d '{"input":"Tr0ub4dor&3"}'
The tool won't make you choose better passwords — but it'll tell you the truth about the ones you have, and that's the first step. Strong passwords are a habit, not a character count.