The meters that supposedly tell you when you’ve entered enough different characters to make a secure password when signing up for a new site are next to useless, according to a web security consultant.



The meters, which often appear as a bar that goes from red to green, rank passwords using traditional measures such as complexity, length and character use, but it turns out most fail to spot easy to guess or predictable passwords. This results in them giving users a false sense of security, or worse, downright terrible advice.

Mark Stockley, founder of Compound Eye web consultants, said: “The trouble is that most password strength meters don’t actually measure password strength at all. The only good way to measure the strength of a password is to try and crack it – a serious and seriously time consuming business that requires specialist software and expensive hardware.”

Instead password strength meters measure entropy – the amount of time or energy needed to crack a password using brute force methods. The longer and more complex the password, the longer it will take to crack by simply iterating through a list of all possible passwords. According to Stockley, however, brute force is a password cracker’s last resort.

“Their first line of attack is likely to be based on dictionary words and rules that mimic the common tricks we use to di5gu!se th3m. Measuring entropy doesn’t tell us anything about that,” Stockley said.

Stockley tested five popular password strength meters jQuery Password Strength Meter for Twitter Bootstrap, Strength.js, Mato Ilic’s PWStrength, FormGet’s jQuery Password Strength Checker and Paulund’s jQuery password strength demo.

He used five of the worst passwords possible that appear on a list of the 10,000 most common passwords: abc123, trustno1, ncc1701 (registration number of Star Trek’s USS Enterprise), iloveyou! and primetime21. All five were broken by the open-source password cracking software John the Ripper in under a second.



There is data to suggest that password meters do help users pick better passwords, therefore improving the security of their accounts. Photograph: Alamy Stock Photo

He also tested what is considered to be one of the best password strength meters, the open-source zxcvbn, which is used by Dropbox and Wordpress, among others.

The five popular password meters failed to successfully spot that all five tested passwords were terrible, while zxcvbn identified them as very weak. Arguably they should all simply tell the users not to use the passwords at all. One even ranked trustno1, iloveyou! and primetime21 as “good”.

Stockley said: “The result, sadly, is exactly the same as [the last time I conducted this test in 2015]. They all failed.”

Other researchers have also come to the same conclusion. Microsoft published a paper in 2014 to that effect, while others have urged a shift away from the traditional sense of what a strong password is, using complex character strings that no one can remember.

However, there is data to suggest that password meters do help users pick better passwords, therefore improving the security of their accounts and the site they’re trying to register with as a whole, if they are set up correctly.

The trouble is that most do not exclude popular passwords automatically, which they and the site accepting them should do by default.

Advice on passwords is still conflicted, with many still recommending multiple special character substitutions in real words, but pass phrases – those that use a string of real words to make a very long password easier to remember – have recently become popular.

For those that do not want to use a password manager, Wordpress, the content management system used by millions of websites, recommends using pass phrases such as “copy indicate trap bright” avoiding a predictable series of words:

“Because the length of a password is one of the primary factors in how strong it is, passphrases are much more secure than traditional passwords. At the same time, they are also much easier to remember and type.”

Two-step verification, which uses another piece of information or a code generated by an app, keyfob or sent in a text message, is also highly recommended because it means attackers need to do more than simply crack or know a users password. Most high-profile sites and services have two-step systems, and while being another barrier to entry, they should be used.