To show what a password strength meter of recognized quality is capable of, Stockley also added zxcvbn —an open-source meter used by Dropbox that he considers a “ringer”—to his test.

Writing for Sophos, he explained that password meters only attempt to measure how long it would take to crack the password. A meter on the website typically suggests you use a long password with ...

When you make a new account for any sort of web site or service, there’s usually a helpful-looking meter to tell how strong the password you came up with is. Don’t listen to those meters.