How the Estimate Works
The checker computes entropy: the character pool implied by what you typed (lowercase 26, +uppercase 26, +digits 10, +symbols ~32) raised to the power of its length. Crack time assumes an offline attacker running 100 billion guesses per second — realistic for a stolen password database attacked with modern GPU rigs — and reports the average time to find the password (half the total search space).
It also flags patterns that shrink the real search space dramatically: dictionary words, years, repeated characters, and keyboard sequences. A password built from a word plus a year may show decent raw entropy, but cracking software tries those constructions first — which is why the checker warns you even when the bar looks long.
Entropy math gives an upper bound on strength. Human-made patterns are always weaker than the math suggests; randomly generated passwords are exactly as strong as the math says. That asymmetry is the whole argument for a random generator.
What to Do With a Weak Result
Don't patch a weak password with an exclamation point — replace it. Generate a random 16+ character password with our password generator, store it in a password manager, and if the account is important, enable two-factor authentication too. For the one password you must memorize, use a 6-word passphrase. The full reasoning is in our strong password guide.