Scores a password against seven concrete checks — length thresholds at 8 and 12 characters, presence of each of the four character classes, and a repeated-run test that fails on three identical characters in a row — then maps the count to Weak (0-2), Fair (3-4), Good (5), or Strong (6-7). Analysis reruns on every keystroke, locally.
What a checklist can and cannot see
These seven checks are the same class of rules signup forms enforce, and they are good at catching structural weaknesses: too short, a single character class, or keyboard-mash repetition (sixteen a's in a row scores only 3/7 because the repeated-run check fails alongside the class checks). What no client-side checklist can know is whether your string appears in breach corpora, encodes your pet's name and birth year, or is reused on five other sites — and those are what attackers try before any brute force. Read the score as 'did I avoid the obvious structural mistakes,' not as a crackability estimate; the two examples above show how far the two can diverge in both directions.
Questions people ask
Does my password get sent anywhere when I type it here?
No — the analysis is a pure function running in your browser, and the page makes no network request with the input. Even so, testing a candidate pattern rather than the exact password you actively use is the better habit anywhere on the web.
Why does adding a symbol jump my score more than adding five characters?
Because the score counts binary checks, and each character class is worth exactly one point while length only has thresholds at 8 and 12. That is a limitation of checklist scoring, not advice — past the thresholds, added length keeps helping in reality even though the meter stops moving.
The password generator produces strings that pass all seven checks by construction, and bcrypt covers the storage side of the same problem.