Password security metrics go far beyond simple length and character requirements. True password strength depends on how resistant a password is to the specific attack methods that adversaries actually use, which include brute force enumeration, dictionary attacks, rule-based mutations, and credential stuffing from leaked databases. A password like "P@ssw0rd123!" meets most traditional complexity requirements (uppercase, lowercase, numbers, symbols, 12+ characters) yet is trivially cracked because it follows an extremely common pattern that attackers prioritize in their rulesets.

Brute force calculations estimate how long an attacker would need to try every possible password of a given length and character set. Modern consumer GPUs can compute billions of hash attempts per second against common algorithms. A single NVIDIA RTX 4090 can test approximately 164 billion MD5 hashes per second, 68 billion SHA-1 hashes, or 22 billion SHA-256 hashes per second. Password hashing algorithms designed to be slow, such as bcrypt, scrypt, and Argon2, dramatically reduce this speed to thousands or millions of attempts per second, making the choice of server-side hashing algorithm as important as the password itself.

Dictionary attacks exploit the human tendency to use meaningful words and predictable patterns. Attackers maintain massive dictionaries compiled from billions of passwords leaked in data breaches, common words in multiple languages, names, places, pop culture references, and keyboard patterns. Rule-based attacks extend dictionaries by applying common transformations: capitalizing the first letter, appending numbers or years, substituting vowels with numbers (a to 4, e to 3, o to 0), and adding symbols at the end. These rules are so effective that passwords like "Summer2024!" or "Monkey123$" are cracked in seconds despite appearing complex to users.

The zxcvbn algorithm, developed by Dropbox, represents a sophisticated approach to password strength estimation. Rather than checking against rigid rules, zxcvbn models the attack strategies that real crackers use. It identifies dictionary words (including reversed and l33t-speak variants), spatial keyboard patterns (qwerty, zxcvbn itself), repeated characters, sequences (abc, 123), dates, and common names. It then estimates crack time by calculating the number of guesses required based on the identified patterns, producing far more accurate strength assessments than traditional rule-based checkers. A password that scores well on zxcvbn genuinely resists the attack methods that compromise accounts in the real world.