Before building our password strength checker, we looked into exactly why this category of tool has a documented accuracy problem.
"Blatantly misleading" isn't our phrase — it's a university's
Researchers at Concordia University evaluated password strength meters from major providers — Apple, Dropbox, Google, Microsoft, PayPal, and more — and concluded that commonly used meters "are highly inconsistent, fail to provide coherent feedback on user choices, and sometimes provide strength measurements that are blatantly misleading." The core problem: meters that lean on raw entropy create a false sense of safety, because entropy doesn't capture how predictable a password's pattern actually is.
We tested it: "password123456"
A 14-character password with letters, numbers, and reasonable length looks fine by a naive character-count or entropy measure. We ran it through this tool directly: it's rated "Weak," with an estimated crack time of two seconds, and the specific reason given is "This is similar to a commonly used password." That's the difference between counting characters and recognizing a pattern.
A checker that says why, not just how much
We also checked passwordmonster.com directly — it does keep everything client-side, which is good, but the interface stops at a score and a crack-time estimate with no diagnostic detail about what's actually wrong. This tool lists the specific issue (a dictionary word, a keyboard pattern, a sequence) and a concrete suggestion, using the same pattern-matching approach (zxcvbn, originally built at Dropbox) instead of a homemade entropy formula.
Never transmitted
Analysis runs entirely in your browser. Given what you're typing into a tool like this, that's not optional.
