Password Strength Meter in Password Vault: What the Levels Mean

Where the meter appears

In the New Item and Edit Properties dialogs of Password Vault, a strength meter is shown directly under the Password field as soon as the field is not empty. It consists of a bar of five segments and the label Strength, for example Strength: Fair. The meter is updated with every character you type, and also when the password generator puts a new password into the field.

The five levels

The meter estimates how hard the password would be to guess and expresses it in bits: each additional bit doubles the number of guesses an attacker would need. The estimate is mapped to five levels:

How the estimate is calculated

The calculation is done in your browser and takes four factors into account.

1. Character pool. The meter checks which kinds of characters the password contains and adds up their number: lowercase letters count as 26, uppercase letters as 26, digits as 10, and any other character (symbols, spaces, letters with diacritics and so on) as 32. A password with all four kinds therefore has a pool of 94 characters, which gives about 6.55 bits per character; a password of lowercase letters only gives about 4.7 bits per character.
2. Effective length. The length is reduced for predictable patterns. Every character that repeats the previous one (aa) or continues an ascending or descending sequence (ab, 21) is not counted. In addition, the effective length cannot exceed twice the number of different characters in the password, so a long password built from a few characters gains little.
3. Bits. The estimate is the effective length multiplied by the bits per character of the pool.
4. Common words. If the password contains one of the well-known weak words — password, passw0rd, qwerty, admin, welcome, letmein, 123456, abc123, iloveyou, 11111 — in any letter case, the estimate is capped at 20 bits, which is always Very weak, however long the rest of the password is.

Examples

The following examples show the level the meter displays for some passwords:

Do not use any of these example passwords.

The meter does not block saving

The meter is indicative only. You can save an entry with a Very weak password — for example when a service dictates the password or you are recording an existing one. Password Vault does not reject or change it; the decision is yours.

Tips for a stronger password

• Make it longer. Length is the most effective factor: every additional random character adds up to 6.55 bits.
• Mix all four kinds of characters — uppercase and lowercase letters, digits and symbols — where the service allows it.
• Avoid patterns: repeated characters, keyboard or alphabet sequences, years and the common words listed above.
• Remember the limits of a small character set. A password made only of digits never reaches Very strong, because it has at most 10 different characters.
• Let the generator do it. A generated password of 16 characters with all four classes is practically always Very strong — see KB10445. How to Generate a Strong Password with the Password Vault Generator.