How to estimate the strength of a candidate password

1. Enter the password

   Drop the candidate into the "Password" field. The check is done locally in your browser — nothing is sent to the server, but treat the form like a real one anyway (don't paste a production password into a tool you don't trust).

2. Press Run

   Result returns `score` (0–4, higher is stronger) and `feedback` (a short hint string like "add more characters" or "avoid common patterns"). The score is heuristic — based on character classes, length, and dictionary hits, similar to zxcvbn-style estimators.

3. What the score really means

   0–1 = trivial to brute-force online (less than a million guesses). 2 = guessable with online attack against unthrottled API. 3 = safe against most online attacks. 4 = safe against offline attacks too. For service logins, aim for 3+.

4. Length beats complexity

   A 20-character lowercase pass-phrase scores higher than an 8-character `Pa$$w0rd!` because length-based entropy compounds faster than punctuation tricks. The XKCD-style "correct horse battery staple" pattern reaches 4 easily.