Password Strength: A Practical Guide for Developers

Why length alone is not enough

Passwords are still the most common authentication mechanism on the web. Yet most people — and many developers — fundamentally misunderstand what makes a password strong. Length matters, but it is not enough. A 16-character password made of dictionary words is far weaker than a 10-character random string.

Attackers do not guess character by character. They use lists of common passwords, dictionary words, keyboard patterns, and leaked databases. A password like "correcthorsebatterystaple" might look complex, but if it follows a predictable pattern, it falls fast.

What entropy actually measures

The real measure of password strength is entropy: how unpredictable the password is to an attacker who knows the generation method. This is why character-count checkers are misleading. They count uppercase, lowercase, numbers, and symbols, but they do not account for patterns.

A password like "P@ssw0rd123!" passes most character-count meters, yet it is cracked in seconds because it is a common mutation of a dictionary word.

How zxcvbn evaluates passwords

A better approach is to use a scientific estimator like zxcvbn, which measures real-world crackability. Developed at Dropbox and open-sourced in 2016, zxcvbn analyzes a password against millions of common passwords, dictionary words, keyboard patterns, and repetition. It returns a score from 0 to 4, along with an estimated crack time and specific warnings. This is the algorithm the DevUtils Password Strength Checker uses.

Four rules for strong passwords

• Use a password manager. Humans are terrible at generating and remembering random strings. A password manager creates 20+ character fully random passwords and stores them securely. You only need to remember one strong master password.
• Never reuse passwords. When a service is breached, attackers try the leaked credentials on other sites. A unique password per service eliminates that risk.
• Enable two-factor authentication everywhere. Even a strong password can be phished or keylogged. A second factor makes stolen credentials useless on their own.
• Check your passwords against breach databases. Services like Have I Been Pwned let you see if a password has appeared in known data breaches. If it has, change it immediately.

Test before you use

Finally, test your passwords with a scientific strength checker before using them. The DevUtils Password Strength Checker gives you a real zxcvbn score, an estimated crack time, and actionable suggestions — all without sending your password to a server.

If you need a new password, the DevUtils Password Generator creates cryptographically strong random strings with customizable length and character sets. Both tools run entirely in your browser, so your credentials never leave your machine.