How to check and test the strength of your passwords

Posted on November 18, 2008 at 5:56 am

I’ve written earlier about how to create strong passwords in order to avoid breaking a password using brute force. I’ve also written about free online password generators that help you create complex and strong passwords.

So now that you have a password, do you really know if is it strong? Is there a way to check and see how strong your password really is? How would it fare against a brute force attack? How long would it take to crack?

Well there are a few tools out there that can give you a pretty good idea of how strong your password really is. Here are a couple of my favorite.

The Password Meter

I really like this online password strength checker because it’s really simply to use and gives you a final score plus detailed reasons on why your password either got a high score or a low score.

Just start typing your password and the score and complexity will automatically be calculated in real time.

You’ll then see two tables below called Additions and Deductions. You’ll see either additional points or negative points depending on whether you met the requirements for the test or failed them.

An X means you failed that test, an exclamation point means it’s ok, but not great, a green check means it meets the minimum standards, and a blue icon means it’s exceptional.

As you can see, my password of “abc123” is not very secure! Now trying to get everything green and with exceptional icons will end up getting you a password like “H$Lf!7%3@8M(d*&C” which is SUPER secure but ridiculously hard to remember! I would think a score over 80% would be very hard to break.

Overall, Password Meter analyzes the basic stuff like number of characters, uppercase, lowercase, symbols, numbers, but it also checks things like consecutive letters, repeated characters, only letters, only numbers, etc.

Hackosis Brute Force Calculator

Using the Hackosis Brute Force calculator, you can quickly see how long it would take a computer that tries 137,438,953,472 passwords per hour. He gets this number by figuring out how many passwords could be tried by a typical PC in 2008 with a 10% load on the processor. Pretty large number of passwords eh?

Most hackers use much more powerful computers to break passwords using brute force, so it would be much higher than 137 billion per hour! This service works by not actually typing your password in, but by entering the types of characters in your password.

For example, if my password is abc123, then I would enter 3 lower case characters, and 3 numbers.