# How I check password strength without fooling myself

A beginner-friendly guide to password strength, entropy, length, common patterns, cracking assumptions, and using a password strength estimator carefully.

- Date: 2026-09-27
- URL: https://ilham.dev/posts/how-to-check-password-strength-without-fooling-yourself/
- Markdown: https://ilham.dev/posts/how-to-check-password-strength-without-fooling-yourself/index.md
- Tags: passwords, security, privacy, tools
- Reading time: 2 min


Password strength is easy to misunderstand. A password can look complicated but still
be weak if it is short or predictable.

The [Password Strength](/tools/password-strength/) tool estimates how hard a password
may be to guess under stated assumptions. It is not magic, but it helps compare
choices.

## The simple idea

A strong password is hard to guess.

Two things matter a lot:

- length;
- unpredictability.

This can be weak:

```text
P@ssw0rd!
```

It looks complex, but it is a common pattern.

This can be much stronger:

```text
river-saturn-window-coffee-72
```

It is longer and easier to remember.

## Step 1: check length first

Length is powerful. Every extra character increases the search space.

A short password with symbols can still be weaker than a long passphrase.

If I can choose, I prefer a long unique password generated by a password manager.

## Step 2: avoid predictable substitutions

Attackers know common substitutions:

```text
a -> @
o -> 0
s -> $
i -> 1
```

So this is not as clever as it looks:

```text
P@ssw0rd2026!
```

It follows a known pattern.

## Step 3: use unique passwords

A strong password reused across sites becomes dangerous if one site leaks it.

Use a different password for every important account. A password manager makes this
practical.

The strength of one password does not help if it is reused everywhere.

## Step 4: understand estimates

A strength estimator makes assumptions, such as how many guesses per second an
attacker can try.

That means the result is an estimate, not a guarantee.

Use it to compare options, not as an absolute promise.

## Step 5: do not paste real passwords everywhere

Be careful where you test passwords. For real accounts, I prefer testing a similar
pattern instead of pasting the exact live password into random tools.

The tool on this site runs in the browser, but the professional habit is still:

> Do not casually paste real secrets unless you understand where they go.

## Step 6: prefer generated passwords for accounts

For most accounts, the best answer is simple:

```text
use a password manager
use a long random password
turn on 2FA
```

Human-made passwords are often patterned. Generated passwords are usually better.

## My password checklist

When judging a password, I check:

1. Is it long enough?
2. Is it unique to this account?
3. Is it free from obvious words and substitutions?
4. Was it generated randomly?
5. Is 2FA enabled for important accounts?
6. Am I avoiding pasting live passwords into places I do not trust?

Password strength is not about looking complicated. It is about being difficult to
guess and not reused.