I'm curious as to how the strength of a password is calculated, because the password I just entered wasn't classed at full strength:

When it is full for Google, Medium for Microsoft and Full for another online checker:

This is the password:


(no I'm not using it for anything).

So what is the score based on here?


As Daniel said, libpwquality is used. Looking in source code, you can see several checks, quality settings - threshholds - will be configured in a configuration file:

  • palindromes
  • simplicity (too little number of digits, lower chars, upper chars and special chars)
  • simplicity (too little different character types - digits, lower chars, upper chars and special chars)
  • Consecutivity (too many repeated characters)
  • similarity to user id or user full name
  • wordlist (bad words from config file)

There are checks for comparing old and new passwords, too.


We use a library called libpwquality

  • @Tim To be honest, I don't personally know the answer to that :p I think it's basically trying to calculate "entropy". If you just keep typing non-repeating lowercase letters you can get a full score after like 20 lowercase characters. Using symbols and mixed case you can get a full score in less chars. But I think the idea is that it's trying to find out how hard it would be to bruteforce this password Jul 1 '15 at 16:04
  • @Tim I'm unsure. I haven't personally read that code. Jul 2 '15 at 2:26
  • 1
    It's fundamentally impossible to make a password strength meter since password strength depends on the generation process, not on the result. Password strength meters range from the dangerously misleading to the merely sometimes-useful. I don't know how this library fares. Can you point to the discussion that led you to choosing this one (over others and over none at all)? Do you offer password choice recommendations? Jul 2 '15 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy