Password Strength assesses a password's length, the character space it uses, its theoretical raw entropy and the effective entropy left after weak patterns are deducted. The implementation also checks predictable patterns such as repeats, sequential runs, keyboard walks, common words and dates, and shows the penalty for each; it then gives a strength grade from the model, crack-time orders under several attack-rate assumptions, and targeted suggestions.

1. 01Type the string to analyse into the password field; it is masked by default and can be revealed manually.
2. 02Read the overall rating and the gap between effective and raw entropy.
3. 03Look at the character-set breakdown and the “weak pattern detection” list to see what was penalised.
4. 04Use the crack-time orders and the suggestions to adjust length, randomness or character mix.

• Raw entropy is estimated as “length × log₂(character space)” and then reduced by the detected weak patterns; this is not a full probabilistic model of real password distributions.
• Crack time is estimated at half the key space on average and is only useful for orders of magnitude; it does not represent the real attack cost against a particular site.
• The tool only detects the repeat, sequence, keyboard-path, common-word and date rules it implements, so a clean result does not mean the password is definitely safe.
• Whether a password is safe also depends on the server's hash algorithm, whether it has leaked, whether it is reused across sites, and multi-factor authentication.
• What it does not do: it does not query breach databases online, does not attempt to crack the password, and does not replace a password manager.

The input takes part in the calculation only in the current page's memory; nothing is written to storage and no network request is sent. The page also states plainly that a real password in use should not be typed in.