Videos
In theory, password strength checkers do not work. That's because the strength of a password does not depend upon the password value (which you give to the checker) but upon the password generation process (which you do not formalize often, let alone enter in the checker).
In practice, password strength checker use a set of rules which describe common password generation methods; they then tell you how long your password would resist if the attacker uses exactly the same rules. But the attacker does not use exactly the same rules. The attacker is after you; he knows you (if you are attacked only by people who do not know you, then you can consider yourself very lucky -- or very uninteresting). Therefore, the attacker will amend his password brute-force methods so as to target your psyche, your probable password generation methods.
Password strength checkers are good at telling you how robust your password is against incompetent attackers. This has some value, if only because there are so many incompetent wannabe hackers. But it would be a mistake to rely too much on such tools.
Synthesizing the answers here, and from looking at the code for several of the (Javascript) password quality checkers, I don't believe there is a checker that fully meets the criteria.
Specifically, while there are several that use wordlists and several that special-case l33t-speak, there are none that do both together in a way that parallels JtR and similar "audit" tools. So "Christmas" is spotted, but the almost-as-insecure "Chr1stm4$" gets a free pass.
Where wordlists are used (Microsoft, Rumkin, How Secure ...), they are generally relatively small. How Secure ... and Rumkin each have ~10K, while JtR has millions of words (across multiple languages).
Also, none of the checkers I found treats the common "append digit/symbol" pattern as any different from "randomly mixed charsets".
If someone wants to extend one of the existing checkers, it probably wouldn't be too hard. Rumkin would be a good place to start (and is GPL licensed), by adding a "de-l33t-ify" step before both the dictionary check and the trigraph frequency lookup. One would also want to add some assumed factor in to reflect the fact that Chr1stma5 is not quite as easy to crack as christmas, e.g. by treating "l33t-ified" as a slightly bigger character set than "letters".
For a corporate environment, spending the time to implement a password change policy of "you get to keep your password until JtR guesses it" (combined with good advice on creating strong passwords/passphrases) would probably be a better persuader -- employees are a captive audience who need to always be able to log in, and people find forced password changes annoying so would soon learn not to use weak passwords (except the CIO who would demand an exemption...). That approach won't work with a public website where irritating your customers may drive them to (less secure!) competitors, though.
According to an online password strength checker, my master password would take a computer 2 hundred octillion years to crack (not sure whether this is a super computer or normal one). It's unique and not used on any other sites. I'm planning to switch from last pass out of principle given the massive security breach but am I right to feel 100% confident that my master password can't be cracked by brute force, or is it not that simple?
In light of the recent LastPass breech I looked at different strength test websites to see how long a password would hold up under a offline brute-force attack.
The password I tried was: Aband0nedFairgr0und
This is a a 19 character password with a combination of uppercase/lowercase/numbers (no special characters)
I went to 5 different password strength sites and they all give me wildly different results for how long it would take to crack.
| https://www.security.org/how-secure-is-my-password/ | 9 quadrillion years |
|---|---|
| https://delinea.com/resources/password-strength-checker | 36 quadrillion years |
| https://password.kaspersky.com/ | 4 months |
| https://bitwarden.com/password-strength/ | 1 day |
As you can see the results are all over the place!
Can anyone recommend the best/ most upto date resource to check password strength. I am sure people with bitcoin mining farming GPUS can crunch 100s of guesses per second.
PS: Dont worry, Aband0nedFairgr0und is not a password I use and was made up as a test.