What the checker looks at
The estimate starts from the length and the kinds of characters used, then takes away strength for patterns that cracking tools try early: common passwords, dictionary words, keyboard runs like qwerty, sequences like abc or 123, repeated characters and years.
The crack times assume an attacker who has to guess, at three speeds: a login form with rate limits, a stolen database protected by a slow hash such as bcrypt, and a stolen database with a fast hash cracked on GPUs. Real attacks vary, so read the numbers as a rough guide rather than a guarantee.
About the breach check
The breach check is optional and only runs when you press the button. It uses the k-anonymity range API from Have I Been Pwned: your browser hashes the password with SHA-1, sends only the first five characters of that hash, and compares the returned list on your device. The password itself never leaves this page.
Frequently asked questions
Is it safe to type my real password here?
The checker runs entirely in your browser and stores nothing. Even so, the safest habit is to test a password before you start using it, and better still to generate new passwords rather than invent them.
Why does a strong-looking password fail the breach check?
Strength estimates measure how hard a password is to guess from scratch. If a password already appeared in a breach, attackers do not need to guess it, they simply try it. Never use a password that has been breached.