Strength explainer
Understand password-strength results
Learn what a meter can observe, what it cannot know, and how to make a better account-level decision.
A meter sees a string, not its history
Length and character variety are easy to count. Reuse, exposure in a breach, a predictable personal pattern, a site’s hashing configuration, rate limits, and whether MFA is enabled are usually invisible to a browser meter. Those missing facts can matter more than the color of a bar.
A password can look complex and still be easy to guess when it is a familiar phrase with substitutions. Conversely, a manager-generated password does not become meaningfully safer because you manually add a memorable suffix.
What RhinoPassword’s checker actually does
This checker is a small heuristic, not a cracking simulation. It scores length in seven-character steps and the presence of lowercase, uppercase, digits, and symbols. It subtracts for three repeated characters and rejects a short built-in list of obvious terms. It does not query breach databases, estimate attack cost, detect keyboard walks broadly, or recognize most names and phrases.
The input is evaluated by JavaScript in this page. The application does not intentionally submit it to an API, but pasting any live password into any webpage expands where that secret exists: the system clipboard, browser extensions, assistive tools, or compromised software may have access. Prefer checking the generation method and uniqueness rather than pasting a current high-value password.
A better four-question check
- Was it generated randomly rather than invented from personal information or a pattern?
- Is it unique to this one account?
- Is it long enough for the service and stored in a password manager?
- Is MFA or a passkey enabled, especially for email, finance, cloud, and the password manager?