Stopped trusting that password strength meter

Built a password with 14 chars that the meter said was 'strong' last month, cracked it in a day with a basic hash list. Why do so many sites still judge by length alone instead of checking against known breaches? Anyone else run into fake strength scores?

1 comments

1 Comment

karen2754d ago

My cousin had the same thing happen with an old gaming account password last year, so I get where you're coming from. But honestly, the meter might be doing its job if you used it right. A 14 char password like "correcthorsebatterystaple" scores high on length but anyone who knows common phrase lists will crack it fast. The real problem is people reuse passwords or pick patterns that length alone can't fix, and no meter can read your brain. If the site checks against breach lists, great, but most users pick a new random string anyway, so length is the only thing they can measure without storing your data in a risky way. You're better off using a password manager to generate something truly random, that beats any meter any day.