What is Password Security Explainer?
Password Security Explainer is a free educational tool that analyzes your password structure and shows you exactly how secure it is. Unlike typical password checkers that just give a score, this tool explains why certain patterns are weak and how long it would take for an attacker to crack your password.
How It Works
- Enter a password pattern (not your real password) — for example,
abc123orTommy2001! - The tool analyzes character types, patterns, and structural weaknesses
- See estimated crack times for three attack scenarios
- Get segment-by-segment risk analysis
- Read personalized recommendations for improvement
What the Analysis Shows
Crack Time Estimates
- Online attack (1,000 guesses/second): Simulates a rate-limited web login
- Offline fast hash (100 billion/second): Simulates cracking stolen MD5/SHA1 hashes on a GPU
- Offline slow hash (10,000/second): Simulates cracking bcrypt/scrypt/PBKDF2 hashes
Character Class Analysis
Shows which character types you’re using (lowercase, uppercase, digits, symbols) and how they contribute to your password’s strength.
Segment Risk Analysis
Breaks your password into segments by character type and identifies dangerous patterns:
- Common words and names
- Sequential characters (abc, 123)
- Keyboard walks (qwerty, asdf)
- Repeated characters
- Date/year patterns
- Common suffixes
What Makes a Password Strong?
| Factor | Impact | Example |
|---|---|---|
| Length > 12 | Critical | 16+ characters highly recommended |
| Mixed case | High | Both uppercase and lowercase |
| Includes digits | High | At least 1-2 digits |
| Includes symbols | High | Even one symbol greatly helps |
| No patterns | High | Avoid sequences, keyboard walks |
| No dictionary words | High | Random character strings are ideal |
| Truly random | Best | Use a password generator |
How Attackers Crack Passwords
- Dictionary attacks — Try common words, names, and password lists
- Pattern attacks — Try known patterns like Word+Number+Symbol
- Brute force — Try every possible combination (infeasible for long, complex passwords)
- Credential stuffing — Use passwords leaked from other sites
The best defense is a long, random password that’s unique for every service. Use a password manager to generate and store them.