Arsenal / Identity and access
Password Strength Lab
Complexity rules fool people. Patterns fool nobody.
Type a password and see how an attacker would actually guess it, generate one that holds up, then see how password managers and passkeys keep secrets off the server.
- Security+ SY0-701 4.6
- Security+ SY0-801 4.5
- Runs in your browser
01 / Strength meter
How fast would it fall?
Try a sample:
| Attack scenario | Time to crack |
|---|
Why it scores this way
- Patterns found in your password will be explained here.
How this meter works
This is a local re-implementation of the approach used by zxcvbn, the open-source estimator Dropbox published (Wheeler, USENIX Security 2016). Instead of counting character types, it hunts for the things attackers try first: common passwords, l33t swaps, reversed words, keyboard walks, repeats, sequences, years and dates. It then finds the cheapest way to build your password from those pieces and counts the guesses. Characters that fit no pattern are treated as random, at 10 guesses per character.
How the label is set: the label follows the toughest realistic case, an attacker with stolen fast hashes at 10 billion guesses per second. Cracked in under 1 second is Very weak, under 1 day Weak, under 1 year Fair, under 1,000 years Strong, and 1,000 years or more (roughly 68+ bits) Very strong. The generator uses the same scale.
Crack times assume the attacker guesses in that smart order and finds the password after the estimated number of guesses. Real speeds vary a lot with hardware and hash settings, so read them as orders of magnitude, not promises.
02 / Generator
Make one that holds up
Word list: 1,220 plain English words built into this page.
Randomness comes from crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling so no character or word is favored. Every pick is independent, which is why the math is simply picks x log2(choices). Capitalizing every word is a fixed rule an attacker would copy, so it adds no entropy.
Why the meter can show a different number: the meter does not know your passphrase came from this list. The generator number assumes the attacker knows the exact list and method, which is the honest worst case. When the two disagree, trust the lower one.
03 / Password managers
How a password manager keeps a secret
One strong master password protects a vault of unique passwords. The trick is that the vault is locked and unlocked on your device. Step through it.
- Master password
- Key derivation
- Encrypt vault
- Sync ciphertext
- Zero-knowledge
- New device
Step 1 of 6
The scrambled text in this diagram is random filler for illustration. No real encryption of your data happens here.
04 / Passkeys
Passkeys: nothing to steal, nothing to phish
A passkey replaces the password with a public/private key pair made just for one website (FIDO2 / WebAuthn). The website keeps only the public key. The private key never leaves your authenticator: a phone, a laptop's secure chip, or a hardware security key.
Sign up
Make the pair
- Your device creates a new key pair for that one site.
- The public key goes to the site. The private key stays locked on your device.
- No shared secret is ever created, so there's nothing for the site to leak.
Sign in
Prove it with a signature
- The site sends a random challenge.
- You unlock the passkey locally with a fingerprint, face, or device PIN. That biometric stays on the device.
- Your device signs the challenge with the private key, and the site checks it with the public key.
Phishing resistance
Tied to the real domain
Each passkey is bound to the site's domain (its relying party ID). On a look-alike site like bank-secure-login.example, your browser simply has no passkey to offer, and there's no code for you to type into the fake page.
Device-bound vs synced
Device-bound passkeys live on one piece of hardware, such as a USB or NFC security key, and can't be copied. Synced passkeys are backed up, end-to-end encrypted, through a passkey provider (for example Apple, Google, or a password manager) so a new phone still has them. Both stay phishing-resistant; synced passkeys trade a bit of control for easier recovery.
Passkey vs password + MFA
| Question | Password + SMS or app code | Passkey |
|---|---|---|
| Can a fake site phish it? | Yes. A real-time proxy can relay both the password and the code. | No. It only works on the domain it was made for. |
| Can it be reused on other sites? | The password often is, which fuels credential stuffing. | No. Every site gets its own key pair. |
| What does a server breach expose? | Password hashes that can be cracked offline. | Public keys, which can't be used to sign in. |
| What do you have to remember? | A password per site, plus your phone. | Nothing new. You unlock your own device. |
| Factors in one step | Something you know + something you have. | Something you have (the device) + something you are or know (biometric or PIN). |
Exam lens
Security+ SY0-801 4.5 (Given a scenario, apply concepts related to identity and access management) lists Password concepts: Passkey, Password managers, Passwordless, Password best practices (Length, Reuse, Expiration, Compromised credential monitoring, Account auditing, Policy report). SY0-701 4.6 covers the same password concepts without passkeys or compromised credential monitoring. Expect scenarios where the best answer is the phishing-resistant option: passkeys or FIDO2 security keys over SMS codes.
05 / Check yourself
Password best practices quiz
Six questions. Pick an answer to see the explanation.
Guidance in this lab follows NIST SP 800-63B (Revision 4, 2025): favor length, check new passwords against lists of breached and common passwords, don't force periodic changes without evidence of compromise, and don't impose composition rules like "one symbol and one number." Crack-time speeds are illustrative assumptions borrowed from zxcvbn's published scenarios; real attacks can be faster or slower.