What password strength meters actually measure

Type a password into a signup form and something underneath it turns from red to amber to green. That widget is making a numerical claim about your password, and it is almost never showing you the number. This piece is about what the number is, how it is worked out, and why two meters can look at one string and come to opposite conclusions.

What the meter is measuring

All of them are estimating the same thing: how many guesses an attacker has to make before they find your password. The unit is the bit, borrowed from information theory, and the reason bits are used is that they add up. A password worth twenty bits of guessing is twice as hard as one worth nineteen and half as hard as one worth twenty-one, which is the property you want when you are comparing two candidates and neither of them is a number you can look at directly.

For a password drawn uniformly at random from an alphabet, the arithmetic is one line:

H = L x log2(A)

L  length, in characters
A  the size of the alphabet the characters were drawn from
H  entropy, in bits

That is the whole of it. So a meter that says "strong" is claiming it has an opinion about two quantities: how long your password is, which it can see, and what alphabet it came from, which it cannot. The guess at the alphabet is where everything goes wrong.

Alphabet size is decided by which characters you are allowed to use, not by which ones you did use. The difference matters more than it sounds:

Characters available	Alphabet size	Bits per character
Lowercase letters	26	4.70
Upper and lowercase	52	5.70
Plus the ten digits	62	5.95
Plus 33 common symbols	95	6.57
Full printable ASCII	94	6.55

The last two rows are a reminder that "more classes" is not a dial you can keep turning. Past the symbols your keyboard shows you, there is nothing left to add — the full printable ASCII range is marginally smaller than the symbol set most generators use, because space is dropped and a couple of ranges are excluded.

Multiply the per-character figure by the length and you have the estimate. The table below is that multiplication done for a few lengths and a few alphabets.

Length	Lowercase only	Letters and digits	All 95 characters
8	37.6 bits	47.6 bits	52.6 bits
10	47.0 bits	59.5 bits	65.7 bits
12	56.4 bits	71.4 bits	78.8 bits
16	75.2 bits	95.2 bits	105.1 bits
20	94.0 bits	119.0 bits	131.4 bits

Read the top-left cell and the bottom-left cell together. Eight lowercase characters is 37.6 bits. Twenty lowercase characters is 94 bits, which is stronger than a twelve-character password built from every symbol on the keyboard and then some. Nothing in that comparison involved punctuation.

What those bits are worth in seconds

Bits are abstract until you price them. A single modern graphics card will work through tens of billions of MD5 candidates per second, and an attacker renting a rack of them is somewhere past a hundred billion. Divide the search space in half — on average you find the answer partway through — and the numbers stop being academic:

Password	Entropy	Time to crack at 100 billion guesses per second
8 lowercase letters	37.6 bits	About a second
10 lowercase letters	47.0 bits	About twelve minutes
12 lowercase letters	56.4 bits	About five and a half days
16 lowercase letters	75.2 bits	Roughly seven thousand years
8 characters, every class	52.6 bits	About nine hours

Two caveats that matter. First, these are times for a password genuinely drawn at random — a human picking eight characters does not reach 37.6 bits, because humans pick from a much smaller effective alphabet than 26. Second, the speed above only applies when the attacker has the hash and it was made with a fast algorithm. A password stored behind a slow, memory-hard hash is thousands of times more expensive per guess, which buys back most of what a short password loses.

Why two meters disagree about the same string

Take Tr0ub4dor&3. Count the characters: eleven. Count the classes: upper, lower, digits, symbols — four. A meter that reasons purely from classes computes 11 x 6.57 and reports about 72 bits, which it will colour bright green. That password appeared in a well-known comic strip, has been in every cracking wordlist since roughly a week after the strip was published, and a rule set can generate it from the dictionary word troubador in a handful of transformations.

A meter that models patterns gives it somewhere near 28 bits. The two meters are running the same formula. The difference is that the first one assumed the alphabet was 95 characters and the second one looked at what the string was made of and decided the space was far smaller than that.

This is the whole disagreement, and it is worth stating plainly: a meter is only as good as its model of how people actually choose passwords. Class-counting meters assume randomness. People are not random. Anything that assumes otherwise is measuring the length of the password and calling it strength.

The substitutions everyone makes

When a site demands one uppercase letter, one digit and one symbol, the responses are so predictable that cracking tools ship them as named rule files. The transformations below are the ones a rule set will try before it tries anything else:

a becomes @, o becomes 0, i and l become 1, e becomes 3, s becomes $.
The capital letter goes on the first character, because that is where the shift key is easiest to reach.
The digit and the symbol go on the end, because that is where they are easiest to append.
If a number is required and the year is available, it is the current year or the user's birth year.

All four of those are guesses about your password that cost the attacker almost nothing to make. Hashcat's rule engines will generate millions of candidates per second from a single dictionary word, and the mutations above are among the first few thousand. Every hour a password policy spends demanding substitutions is an hour spent pushing people into the space that gets searched first.

A composition rule does not add entropy to a password. It adds entropy to the attacker's rule file.

The lever that scales

Every character you add multiplies the search space by the size of the alphabet. Every character class you add multiplies it by the ratio of the two alphabet sizes — and you can only do that a few times before you run out of classes.

Going from lowercase only to all 95 characters multiplies the space by 95/26, which is about 3.7. That is a little under two bits, once, no matter how long the password is. Adding one lowercase character to a twelve-character password multiplies the space by 26 — about 4.7 bits — and it does that again for the next character, and the next. Six extra lowercase characters beat the entire printable character set, and they are easier to type.

This is why NIST's digital identity guidance moved away from composition rules in its 2017 revision and stayed away from them in the 2024 update. The guidance now asks for a minimum length, a check against a list of breached passwords, and nothing else. The reasoning in the document is explicit: composition rules produce predictable substitutions, and predictable substitutions are worth less than the length they cost you in memorability.

What to do instead

Let a manager generate the ones you never type. For an account you reach through a password manager, the password only has to be long and random. Twenty characters drawn from the full set is 131 bits, and you will never memorise it, which is the point.
Spend your memory on the vault, not on the accounts. The one password you do have to remember is the one that opens the manager. That one wants length and it wants to be memorable, which is what a passphrase is for — five or six words from a large list, generated rather than invented. Invented phrases are the failure mode here, not the technique.
Check the one you already have. If a password you use today is on a breach list, its entropy is irrelevant — the search has already been done and the answer is written down. Length does not rescue a password that is sitting in a file of a billion known ones.

Where the tools fit. The Password Generator draws from the 95-character set with rejection sampling, so every character in the set is equally likely — a detail that most generators get wrong by taking a modulo of a random byte and quietly favouring the first characters of the alphabet. It shows you the entropy count as you move the length slider, which is the number this article has been about.

If the password you need is one you have to remember, the Passphrase Generator builds it from a word list instead, and shows the same bit count so you can compare the two directly.

The short version

Strength is length multiplied by the size of the space you drew from, and the second of those is almost always smaller than the meter thinks it is. A green bar is an opinion about your password, not a fact about it. If you take one thing away from this piece, take the arithmetic: bits add up linearly with length and logarithmically with character classes, so the cheap move is more characters, and the expensive move is everything else.