How to Check Password Strength — What Makes a Password Unbreakable?

The Password Problem — Why Most People Are Vulnerable

According to global cybersecurity research, the most common passwords used around the world continue to be embarrassingly easy to guess: "123456," "password," "qwerty," "iloveyou," and birth years like "1990" or "2000." In India, common weak passwords include names like "rahul123," "india@123," mobile numbers, and cricket player names. These passwords can be cracked in milliseconds using freely available tools.

The consequences of a cracked password are serious: unauthorised access to email accounts, bank accounts, social media, WhatsApp, cloud storage, and work systems. Data breaches at major websites have exposed billions of usernames and passwords over the years — and if you reuse the same password across multiple sites, a breach at one site compromises all your accounts. Understanding what makes a password strong is the first step to protecting your digital life.

What Makes Passwords Weak — The Common Mistakes

A password can be weak in several different ways. Here are the most common weaknesses that attackers exploit:

Too short: Any password under 8 characters is considered weak. Under 6 characters can be brute-forced in seconds on modern hardware regardless of complexity.
Dictionary words: Any word that appears in a dictionary — in any language, including Hindi, Tamil, or Marathi transliterated into English — is vulnerable to "dictionary attacks" where attackers systematically try every known word.
Predictable patterns: Keyboard walks like "qwerty," "1q2w3e," or "asdfgh"; sequential numbers like "123456789"; and repeated characters like "aaaaaa" are among the first patterns tested by cracking tools.
Personal information: Names, birthdays, anniversaries, mobile numbers, vehicle numbers, and PAN/Aadhaar numbers are easy targets because attackers can often find this information on social media.
Leetspeak substitutions: Replacing "a" with "@," "e" with "3," or "o" with "0" (like "p@ssw0rd") is well-known to cracking algorithms and provides minimal additional security over the original word.
Reused passwords: Using the same password on multiple accounts means a breach anywhere compromises everywhere.

Understanding Brute Force and Dictionary Attacks

To appreciate why password length and randomness matter so much, it helps to understand how passwords are actually cracked:

Brute Force Attack: The attacker's software systematically tries every possible combination of characters — starting with "a," then "b," through to "z," then "aa," "ab," and so on. A modern consumer GPU can test billions of combinations per second. An 8-character password using only lowercase letters has 26⁸ ≈ 208 billion combinations — which sounds like a lot, but a powerful computer can crack it in under a minute.
Dictionary Attack: Instead of trying every combination, the attacker uses a pre-built list of millions of common words, names, phrases, and previously leaked passwords. These lists are publicly available and cover words in dozens of languages. Any password that matches an entry in these lists is cracked almost instantly regardless of its length.
Credential Stuffing: Attackers take username/password combinations leaked from one website breach and automatically test them against hundreds of other sites. This is why password reuse is so dangerous — one breach at a minor website can compromise your email, bank, and social accounts.

How to Use the Password Strength Checker

Our free Security and Privacy Tools include a password strength checker. Here is how to use it to evaluate and improve your passwords:

Open the tool: Navigate to Security and Privacy Tools and select the Password Strength Checker.
Type your password: Enter the password you want to evaluate. The tool analyses it in real time as you type — nothing is sent to any server.
Review the strength meter: The tool displays a visual strength indicator — typically rated as Weak, Fair, Good, Strong, or Very Strong — along with an estimated time to crack the password.
Read the feedback: The tool highlights specific weaknesses — "too short," "contains a common word," "no uppercase letters," etc. — and suggests improvements.
Improve and re-test: Modify the password based on the feedback and re-test until it reaches Strong or Very Strong. Alternatively, click "Generate a strong password" to use our Password Generator for a cryptographically random alternative.

Passphrases: The Best of Both Worlds

Security experts now widely recommend passphrases over traditional passwords because they balance memorability with genuine strength. A passphrase is a sequence of 4–6 random, unrelated words — for example: mango-river-purple-laptop. Why are passphrases so effective?

Length: A 4-word passphrase is typically 20–30 characters long — far longer than most traditional passwords, which makes brute force attacks exponentially harder.
Entropy: Random words chosen from a large dictionary have high entropy (unpredictability), making dictionary attacks ineffective because the attacker would need to guess the exact combination of words and their order.
Memorability: Unlike a random string of characters (Xk9#mP2!), words are easy to remember — especially if you create a mental image connecting them.
Practical resistance: Even a "weak" passphrase like mango-river-purple-laptop would take modern hardware thousands of years to crack, while being far easier to type correctly than Xk9#mP2!vR7$.

Multi-Factor Authentication — Your Final Line of Defence

Even the strongest password can be compromised through phishing, keyloggers, or data breaches. Multi-factor authentication (MFA) adds a second verification step so that a password alone is never enough to access your account:

SMS OTP: A one-time password sent to your registered mobile number. Used by almost all Indian banks, Gmail, and government portals. Convenient but less secure than app-based MFA (SIM swap attacks are possible).
Authenticator App: Apps like Google Authenticator, Microsoft Authenticator, or Authy generate time-based OTPs (TOTP) that expire every 30 seconds. Far more secure than SMS OTP and free to use.
Hardware Security Key: A physical USB or NFC key (like a YubiKey) that must be plugged in or tapped to authenticate. The most secure MFA option, but less convenient for everyday use.

Enable MFA on every account that supports it — especially your email, banking, Google account, and social media. With a strong password and MFA, your account is effectively impossible to compromise through automated attacks.

Summary

Password strength is not about memorising complex strings of symbols — it is about length, randomness, and uniqueness. Use the free Password Strength Checker to evaluate your current passwords, generate new strong ones with our Password Generator, adopt passphrases for accounts you need to type manually, store them in a password manager, and enable multi-factor authentication everywhere. These habits cost nothing and protect everything.