Password Strength Calculator

A strong password has: Length (12+ characters — each character multiplies possibilities). Character variety (uppercase, lowercase, digits, symbols). Randomness (no dictionary words, names, dates). Uniqueness (different for every site). A 16-character random password with full charset takes centuries to crack even with fast hardware.

Entropy = log2(charsetSize ^ length) bits. Charset size: lowercase only=26, +uppercase=52, +digits=62, +symbols=94. A 12-character password using all character types: log2(94^12) ≈ 78.8 bits. Each additional character adds log2(94) ≈ 6.6 bits of entropy. 60+ bits is considered minimum strong.

Using predictable patterns: dictionary words, names, dates, or simple substitutions (p@ssw0rd). Password re-use across sites is a major risk — if one site is breached, all your accounts are at risk. Most attacks use credential stuffing from known breach databases, not brute force.

Yes — strongly recommended. A password manager generates and stores unique strong passwords for every site. You only need to remember one strong master password. Top options: Bitwarden (free, open source), 1Password, LastPass. Browser built-in password managers (Chrome, Safari) are also good for most people.

MFA requires a second proof beyond your password: a code from an authenticator app, SMS code, biometric (fingerprint/face), or hardware key. Even if your password is stolen, MFA blocks the attacker. Use authenticator apps (Google Authenticator, Authy) rather than SMS for best security. MFA is the single most effective account protection measure.