Why Your “Strong” Password Probably Isn’t — And a Tool I Built to Prove It

Quick question: how good is your password, really?

Not “does it have a capital letter and a number” good. I mean if someone actually sat down and tried to crack it, how long would it hold up? A few seconds? A few years?

Most of us have no clue. We follow whatever rules the signup form throws at us — one uppercase, one number, one of those little symbols — and we assume that means we’re covered. I used to think exactly the same thing. Then I started digging into how password cracking actually works, and honestly it kind of rearranged my brain. So I built a little browser tool called Entropy Lab to show, in real time, exactly how strong (or how embarrassing) a password is.

This is the story of what I learned building it, written for anyone who, like me a while ago, thought “Summer2024!” was a pretty solid choice.

First off — what even is “entropy”?

Entropy sounds like a scary physics word, but for passwords it just means one thing: how unpredictable is it?

Think of it like guessing. If your password is 1234, there are only 10,000 possible combinations, and a computer chews through that instantly. If your password is a long, random mess of characters, there are so many possible combinations that guessing them all would take basically forever. That “basically forever” is high entropy. Low entropy = easy to guess. High entropy = hard to guess.

The important part is that entropy isn’t about how weird your password looks to you. It’s about how many guesses a machine would need to land on it.

The rules your signup form taught you are kind of a lie

Here’s the thing that got me. Those “must contain a symbol and a number” rules feel like security, but they mostly just create the illusion of it.

Take P@ssw0rd. It’s got a capital letter, a symbol, and a number. It sails right through most signup forms. And it’s one of the first things any cracking tool tries, because attackers know all the little swaps we make. Turning a into @, o into 0, s into $ — those aren’t clever tricks. They’re the most predictable moves in the book, and cracking software has known them for years.

So you end up with a password that’s annoying for you to type and remember, but trivial for a computer to guess. Worst of both worlds. I call this complexity theater, and once you see it you can’t unsee it.

Length beats complexity almost every time

This was the big lightbulb moment for me: a long, boring password usually crushes a short, “complex” one.

Compare X7#k! with correct horse battery staple. The first one looks hardcore. The second one looks like something a toddler said. But the second one is dramatically harder to crack, purely because it’s longer. Every extra character multiplies the number of possible combinations, and length adds up way faster than throwing in a random $.

This is why passphrases — a few random words strung together — are so good. purple-tractor-mango-lamp is easy for a human to remember and a nightmare for a machine to guess. Long and memorable beats short and cryptic. That felt backwards to me at first, but the math is very much on the side of length.

Even a perfect password can already be burned

Now here’s the part that has nothing to do with how strong your password is: it might already be out there.

Over the years, tons of websites have been breached, and the passwords people used on them have leaked into giant lists that attackers pass around. So even if you pick a genuinely strong password, if it’s showed up in one of those leaks, it’s effectively dead. Attackers don’t need to crack it — they just look it up.

This is where a service called Have I Been Pwned comes in. It keeps a massive database of passwords that have appeared in known breaches, so you can check whether the one you’re using has already been exposed. Entropy Lab plugs into this, so it doesn’t just tell you if your password is strong — it tells you if it’s compromised. Those are two totally different questions, and you want a “no” on both.

“Wait — am I typing my password into some random website?”

This was my exact reaction the first time I saw a breach checker, and it’s a completely fair one. Feels sketchy to type your real password into a box on the internet.

So here’s how it actually works, because it’s genuinely clever. When you check a password against Have I Been Pwned, your password never leaves your device in a readable form. It gets scrambled into a hash first, and then only the first few characters of that hash get sent over. The service replies with a chunk of possible matches, and the final comparison happens right there on your machine. The site on the other end never sees your actual password — not even close.

Entropy Lab runs everything right in your browser too. Nothing’s getting logged, stored, or shipped off somewhere. I built it that way on purpose, because a tool that asks you to trust it with your passwords should earn that trust.

So what does Entropy Lab actually do?

It’s a single page, no signup, no download. You type a password in and it shows you, live as you type:

A strength score — using a well-regarded estimator (the same kind of engine that powers strength meters on some big sites), so it judges your password the way an attacker would, not the way a lazy signup form does.
A crack-time estimate — a rough sense of how long your password would survive an actual guessing attack. Watching this jump from “instantly” to “centuries” as you add words is weirdly addictive.
A breach check — whether your password has turned up in a known leak, using the private lookup method I described above.

The whole point is to make something invisible feel visible. You get to watch what makes a password weak or strong instead of just being told.

So what should you actually do?

If you take nothing else from this, here’s the short version:

Go long. A passphrase of a few random words beats a short cryptic string. Length is your best friend.
Stop reusing passwords. One leaked site shouldn’t unlock your whole life. Every account gets its own.
Use a password manager. It generates and remembers long random passwords so you don’t have to. This one change fixes most of the problem overnight.
Turn on two-factor authentication wherever you can, so even a stolen password isn’t enough on its own.
Run your passwords through a checker — like Entropy Lab — so you’re working with facts instead of vibes.

I built Entropy Lab mostly because I wanted to understand this stuff myself, and it turned out to be the clearest way to explain it to other people too. Go break it, throw your worst passwords at it, and see how they hold up. Just, uh… maybe change any that come back “instantly.”

Try it out and let me know what you think. And if your everyday password cracks in under a second — no judgment, mine did too. That’s kind of the whole point.