Check and generate strong passwords SHADOWKEY

What "strong" is measured against

The number here is not a count of character types. A password scored by "has an uppercase, a number and a symbol" rewards Password1!, which is among the first thousand strings any attacker tries, and punishes a long passphrase that would take centuries. That rule shaped twenty years of password policy and it was wrong.

The estimate here is how many guesses it would take, given the way guessing actually works: dictionaries first, then names and dates, then the substitutions people think are clever (a to @, e to 3), then keyboard runs, then the common patterns of a word with a number and a symbol stuck on the end. A password is only as strong as the cheapest route to it.

Reading the time it gives

The figure assumes an attacker with the leaked hashes and a graphics card, which is the situation that matters: an attacker guessing at a live login form is rate-limited and locked out, and nobody breaks a password that way. Offline, a consumer card tries billions of candidates a second against a fast hash.

So treat the number as an order of magnitude rather than a prediction, and remember what it cannot know: whether that password is already in a breach corpus, in which case it takes one guess however complex it looks. PWNCHECK answers that question, and it is a different question from this one. A password can be excellent by this measure and already public.

The advice that actually holds

• Length beats character classes. Four or five random words are easier to remember and far harder to guess than eight characters of punctuation.
• Random means chosen by something that is not you. A person picking "random" words picks memorable ones, which is a much smaller set. Generate them.
• Never reuse one. This matters more than strength: credential stuffing takes a breached pair and tries it everywhere, so the strongest password in the world protects nothing once the site you used it on is breached.
• Unique passwords mean a manager. Nobody remembers forty. KEYS is one that lives in this browser with no account, and any reputable manager is better than reuse.

Nothing typed here is sent anywhere, which you can confirm by turning the network off after the page has loaded and watching it keep working.