Why does my complex password score badly?

Because complexity rules and unpredictability are different things. Capital-word plus digits plus a trailing symbol is one of the most predictable structures there is, and attackers generate it first.

Is the crack-time estimate reliable?

As an order of magnitude, given an assumed hashing algorithm and hardware. Treat it as a comparison between passwords, not as a prediction.

Should I type my real password in?

Prefer not to. Test a password with the same structure instead — the estimate depends on pattern, not on the exact words.

What should a password policy require?

A minimum length of 12–16 characters, a check against known-breached passwords, and no forced periodic rotation. That is current NIST guidance and it outperforms composition rules.

Security🌐 YAS server-sideAPI availableintermediate

Password Strength

Estimates password strength: entropy, crack time and common-pattern feedback.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Estimates password strength: entropy, crack time and common-pattern feedback.

Why would I use it?

You want to know if a password is strong enough before using it.
You are setting a policy for a team or product.
You want concrete feedback, not just 'weak/strong'.

Real-life example

Input

CorrectHorseBatteryStaple

Output

~94 bits — centuries to crack (offline)

Length and randomness dominate strength.

Input → Process → Output → Next

Input: Type or paste a password.
Process: YAS estimates entropy and checks for common patterns.
Output: Entropy bits, estimated crack time, and warnings.
Next action: Strengthen weak passwords and enable 2FA where possible.

Common mistakes

Typing a real password you use (it is analyzed server-side — use a dummy).
Relying on a single dictionary word with substitutions.
Believing complexity rules matter more than length.

What the result means

Higher entropy = exponentially more guesses required.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/password-strength

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/password-strength" \
  -H "Content-Type: application/json" \
  -d '{"input":"Tr0ub4dor&3"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/password-strength", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "Tr0ub4dor&3"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/password-strength", json={"input":"Tr0ub4dor&3"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Password to evaluate

Success response

{ "result": { "score": 3, "length": 11, "entropyBits": 58.4, "crackFast": "4 days", "crackBcrypt": "102k years", "feedback": ["..."] } }

Entropy estimate, crack-time (fast hash & bcrypt), and actionable feedback (zxcvbn-flavored).

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Password Strength works

Strength estimation does not count character classes. It searches for the cheapest way an attacker could generate the candidate: dictionary words with common substitutions, names, dates, keyboard walks (qwerty, 1qaz2wsx), repeats and sequences. Each recognised pattern is assigned the number of guesses required to reach it, and the total is the product along the cheapest decomposition — the approach popularised by Dropbox's zxcvbn.

This is why P@ssw0rd123! scores badly despite satisfying every complexity rule ever written: it decomposes into a dictionary word, a predictable substitution set and a common suffix, costing an attacker a few thousand guesses. Meanwhile a five-word random phrase with no capitals scores well because no pattern shortens the search.

When to use it: real-world scenarios

Explaining to a stakeholder why a policy fails

A live demonstration that a policy-compliant password is weak, and a non-compliant one is strong, changes the conversation faster than a citation.

Choosing a threshold for signup validation

Test candidate thresholds against realistic user passwords to find a bar that blocks the genuinely weak without rejecting reasonable choices.

Auditing a shared or legacy credential

Service account passwords chosen years ago by a human are usually the weakest link in an otherwise modern system.

Teaching password selection

The pattern breakdown shows exactly which part of a password an attacker gets for free, which is more instructive than a score.

Pro tips

Crack-time figures are estimates that depend entirely on the attacker's hashing speed. An offline attack against unsalted MD5 is many orders of magnitude faster than one against Argon2id.
Do not enter a live password you use. Test a structurally similar one — same pattern, different words.
Reject passwords found in breach corpora rather than enforcing composition rules; NIST SP 800-63B recommends exactly this.
Length is the dominant factor once patterns are eliminated. Guidance that emphasises symbols over length is optimising the wrong variable.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Estimates are heuristic. A password using a pattern the estimator does not know scores higher than it deserves.
Dictionaries are language-limited; a common word in a language not covered looks like random characters.
The estimator cannot know whether the password appears in a breach corpus, which is the single most important real-world signal.
This page carries no advertising by design, since it processes credential-like input.

Frequently asked questions

Why does my complex password score badly?: Because complexity rules and unpredictability are different things. Capital-word plus digits plus a trailing symbol is one of the most predictable structures there is, and attackers generate it first.
Is the crack-time estimate reliable?: As an order of magnitude, given an assumed hashing algorithm and hardware. Treat it as a comparison between passwords, not as a prediction.
Should I type my real password in?: Prefer not to. Test a password with the same structure instead — the estimate depends on pattern, not on the exact words.
What should a password policy require?: A minimum length of 12–16 characters, a check against known-breached passwords, and no forced periodic rotation. That is current NIST guidance and it outperforms composition rules.

Related tools

Password Generator Passphrase Generator