How to Rate a Password
By Tools Star Hub Editorial Team · Published
To rate a password, multiply its length by the base-2 log of the character pool, then read the label. Under 50 bits is Short, under 80 is Moderate, and 80 or more is Strong. The pool grows only for character types that actually appear. The password stays in this browser tab. The page does not look up breaches, and it does not know whether a site will accept the password.
A short word can look familiar and still rate Short. password is 8 characters of lowercase letters. The pool is 26. The estimate is about 37.6 bits, the page rounds that to 38, and the rating is Short because 37.6 is under 50. Eight digits use a pool of 10, which is about 27 bits, also Short.
How to rate a password
- Type the password. An empty box is rejected. The password can be up to 256 characters. The check runs in this browser tab. Tools Star Hub does not send the password to a server or save it in local storage.
- Press Check. Uppercase adds 26 if an A through Z appears. Lowercase adds 26 if an a through z appears. A digit adds 10. A symbol in !@#$%^&*()-_=+[]{};:,.? adds 23. A character outside those sets, including a space or a backtick, adds one for each distinct character. Accented letters count as other characters, not as A through Z.
- Read the length, the bits, the pool, and the label. Bits are the length times the base-2 log of the pool. The page shows that estimate rounded to a whole number. The label uses the estimate before rounding: under 50 is Short, under 80 is Moderate, and 80 or more is Strong.
- Use a generator when you want a new password. This page rates what you typed. The Password Generator rates a password from the types you selected before it was created. Neither page compares the password with a breach list.
Example
A lowercase word
password is 8 characters of lowercase letters. The pool is 26, the estimate rounds to 38 bits, and the rating is Short.
Letters, a number, and a symbol
Abcdefghijklm12! is 16 characters with uppercase, lowercase, numbers, and a symbol. The pool is 85, the estimate rounds to 103 bits, and the rating is Strong.
Things to watch
A space is not the symbol set
abc def is lowercase plus one other character, so the pool is 27. A backtick is also one other character, not the 23-symbol set.
What the rating leaves out
Up to 256 characters. The page does not look up breaches, and it does not know whether a site will accept the password. Accented letters count as other characters, not as A through Z.
FAQ
- How does password come out to 38 bits?
- It is 8 lowercase letters, so the pool is 26. Length times the base-2 log of 26 is about 37.6. The page rounds that to 38. The rating stays Short because 37.6 is under 50.
- What does a space add to the pool?
- One, for that distinct character. abc def uses lowercase and one other character, so the pool is 27. A space is not treated as the 23-symbol set.
- When is the rating Strong?
- When the estimate is 80 bits or more. Abcdefghijklm12! is 16 characters and a pool of 85, which rounds to 103 bits, so the rating is Strong. Under 50 is Short, and under 80 is Moderate.
- How is this different from generating a password?
- This page rates the characters you typed. The Password Generator rates a new password from the types selected before it is created. This check does not look up breaches.
To rate a typed password from its length and character types, use the Password Strength Checker. It runs in the browser and does not check a breach list.