Start with the threat, not the number
Password guessing takes different forms. An online attacker must interact with a service, where rate limits and multifactor authentication may slow attempts. An offline attacker works against stolen password hashes and is constrained by the hashing method and available computing resources. Those situations cannot share a reliable, universal “time to crack.”
SecureCheck deliberately avoids that claim. Its zero-to-one-hundred score is an explainable local heuristic. It highlights construction weaknesses without pretending to know a service’s defenses, whether your password has leaked, or what an attacker already knows about you. Treat the result as feedback on composition, not a certification.
How this checker calculates its score
The calculation awards three points per Unicode code point, up to twenty characters. It adds ten points for each detected category: uppercase letters, lowercase letters, decimal digits, and non-letter, non-number, non-whitespace characters. The maximum before penalties is one hundred. Spaces count toward length but do not earn the special-character bonus.
A detected common pattern subtracts thirty points. Repetition subtracts twenty. Results cannot fall below zero. Passwords shorter than twelve characters are capped at thirty-nine; those between twelve and fifteen are capped at sixty-nine. Pattern or repetition findings cap the result at forty-nine. Missing a character category caps it at seventy-nine.
Scores below forty are labeled weak, forty through fifty-nine limited, sixty through seventy-nine moderate, and eighty or above strong by this checklist. These boundaries are interface guidance, not measured probabilities. The checklist separately asks for sixteen characters, all four categories, and no detected pattern or repetition.
Why length helps—and when it does not
Adding independently random characters increases the number of possible combinations. Adding a familiar ending, repeating a short unit, or extending a keyboard run does not provide the same benefit. A long, predictable construction can remain easy to prioritize in a guessing attack.
Long passphrases can be a sensible alternative when the component words are selected independently at random. A favorite quotation, lyric, or personal sentence does not have that property. This simple checker does not model passphrase word selection, so it may underrate a well-generated phrase that lacks multiple character categories. A checklist is not a universal password policy.
Character variety has a supporting role
Using more character types expands the available alphabet when selection is random. It does much less when a person follows predictable rules, such as capitalizing the beginning and placing punctuation at the end. Attackers can prioritize those transformations without trying every possible string.
SecureCheck recognizes Unicode letter and digit categories, but it counts code points rather than visible grapheme clusters. Some symbols therefore contribute more than one count. A destination service may impose different length limits, normalize characters, or reject certain symbols. Confirm its requirements before saving a newly generated credential.
What the tool cannot determine
No password is sent to a breach service, and no local list can cover every common credential. A clean pattern result means only that this implementation found none of its configured patterns. It does not mean the password is absent from leaked data or unknown to someone else.
The checker also cannot detect reuse across accounts, personal information it has not been given, malicious extensions, or a compromised operating system. Never enter an existing high-value secret into a site you do not trust simply to obtain a score. Local processing reduces exposure; it does not eliminate every risk.
A useful decision sequence
First, create a unique credential for the account. Prefer a password manager’s secure generator or the browser generator on this site. Next, check that the destination accepts the complete value and save it in your manager. Then enable multifactor authentication or a passkey where available.
Change a password when it is exposed, reused, or otherwise suspected to be compromised. Do not replace genuine randomness with a memorable pattern merely to satisfy a meter. The objective is an account an attacker cannot access, not a perfect-looking number.
Open the private checker