Entropy: counting an attacker's work
A password-guessing attack, stripped of drama, is a search. The attacker tries candidates — first the obvious ones, then systematically through everything a password could be — until one works. A strength meter tries to estimate the size of that search space for your password, and expresses it in bits of entropy.
The maths is pleasantly simple. If a password is chosen randomly from a pool of possible characters, every character multiplies the number of combinations. Entropy is that total, measured on a logarithmic scale: a password of length L drawn from a pool of size N has about L × log2(N) bits. Each extra bit doubles the attacker's work. A 40-bit password means roughly a trillion combinations; at 80 bits, the count has 24 zeros after it, and brute force stops being a plan and becomes a hope.
Length versus complexity: the trade-off, in numbers
Because characters multiply, there are two ways to grow the search space: a bigger pool, or more characters. They are not equal. Lowercase letters give a pool of 26 (about 4.7 bits per character); the full keyboard set of letters, digits and symbols gives about 94 (about 6.6 bits per character). So an 8-character password using everything tops out near 53 bits, while a plain lowercase password needs only 12 characters to pass it — and 16 lowercase characters reach roughly 75 bits. Symbols help, but length helps more, and it is far kinder to the human who has to type the result. This is the arithmetic behind the modern advice: long beats complicated.
There is a catch hiding in the word "randomly". All of these numbers assume each character was picked unpredictably. Human choices are anything but — and that is where meters start to argue with each other.
Why meters disagree about the same password
A simple meter does the pool calculation above and stops. Feed it Password1! and it sees eleven characters from the full pool and reports healthy strength. A smarter meter — the family popularised by estimators that model real guessing — looks for patterns first: dictionary words, names, dates, keyboard walks like qwerty, repeated characters, and the classic substitutions where @ replaces a and 0 replaces o. Attackers try all of these in the first minutes of an attack, so the smarter meter scores the password by its most predictable reading, not its most flattering one. Same password, two verdicts — and the harsher meter is the honest one. When you meet a disagreement, believe the lower score.
How guessing attacks actually work
Attackers rarely guess against a live login page, which is slow and usually rate-limited. The dangerous scenario is a stolen password database, attacked offline on fast hardware that can test billions of candidates per second against weakly stored hashes. In that world, anything under roughly 60 bits of genuine, pattern-free entropy is a matter of time. It is also why a breach at one site endangers your accounts elsewhere: the attackers take the cracked passwords and try them, unchanged, everywhere — a trick called credential stuffing that no strength bar on any single site can defend you against.
What actually keeps accounts safe
- Uniqueness first. A different password for every account, so one site's breach cannot unlock the rest of your life. This single habit defeats credential stuffing entirely.
- Length over decoration. Sixteen or more characters, or a passphrase of several random words — memorable for you, enormous for a search algorithm.
- A password manager. It remembers what you cannot, generates what you would not, and — quietly invaluable — only fills credentials on the real site, which makes it a phishing tripwire too.
- Random generation over invention. Let a generator pick. Humans inventing "random" passwords produce patterns at a rate that would embarrass them if they could see the statistics.
- A second factor where it counts. Email, banking and your password manager itself deserve the extra step; a stolen password alone then buys an attacker nothing.
The meter, used well, is a teaching tool: it trains your eye to value length and randomness over symbol salad. Read it as an estimate with assumptions, generated passwords beat the estimate honestly, and the bar turns green for a reason you can explain.
Try it: watch the entropy score move as you drag the length slider in the Password Generator — then switch to the Passphrase Generator and see how a handful of ordinary words reaches the same strength while staying easy to remember.