The check runs entirely in your browser, and the password is never sent to our server or stored. That said, it's a good habit to test a password that is similar to your real one rather than the exact one, and to avoid using any password tool on a shared or untrusted computer.

It uses the zxcvbn estimator, which looks for the patterns attackers try first: common passwords, names, dictionary words, dates, keyboard runs like “qwerty”, repeats, and predictable substitutions such as “p@ssw0rd”. It then estimates how many guesses it would take, rather than only counting character types.

The tiles only count what your password contains, while the score measures how predictable it is. A password like “Password1!” has uppercase, lowercase, a number and a symbol, but it's one of the first things an attacker would try, so it scores poorly.

They are estimates of how long a guessing attack would take under four scenarios. Online attacks hit a login page and are slow, especially when the site limits attempts. Offline attacks happen after a site's password database is stolen and are far faster, so the offline figures are the ones to pay most attention to.

These are rough guides rather than guarantees, since real attackers and hardware vary.

At least 10 characters is a reasonable minimum, and 16 or more is better for email, banking and your password manager. A passphrase made of four or more random words is also a strong, memorable option.

Spaces are optional. Many sites allow them, which makes passphrases easy to type, but some reject them. If a site refuses spaces, use dashes or simply run the words together.