How the estimate is calculated

The checker counts the length of what you typed and the size of the character set you used (26 for lowercase, 26 more for uppercase, 10 for digits, 33 for common symbols). Length times the size of that set gives a rough number of possible passwords, expressed in bits. Every extra character multiplies the work for an attacker, which is why length beats complexity.

It then looks for patterns that cracking software tries first: a dictionary word, a keyboard run like qwer, a repeated character, a four digit year. Each pattern found knocks roughly twelve bits off the score, because a real attacker does not guess randomly, they guess the likely things first.

The time shown assumes the worst realistic case: someone stole a database of password hashes and is guessing offline at around a hundred billion attempts per second on rented hardware. An attacker typing into a login form gets a few guesses per minute, so the real world number is far friendlier. Design for the bad case.

What the tool cannot see

It does not know whether your password has already appeared in a breach, and a leaked password is worthless no matter how strong it looks. A twenty character passphrase that leaked last year fails immediately, while the checker still calls it very strong. Read how to check whether a password has leaked, then what makes a password strong for the rules behind the score.

The better long term answer is not a stronger password you memorize, it is a password manager that generates a different long random password for every account, plus two-factor authentication on the accounts that matter.