Password Strength Checker

The scoring formula: four flags are set based on regular-expression tests — whether the password contains a lower-case letter, an upper-case letter, a digit, and a "symbol" (any character that is none of the above). Each present type contributes a fixed number of characters to an assumed pool size: 26 for lower case, 26 for upper case, 10 for digits, and 32 for symbols — a documented, deliberately conservative assumption for the size of the symbol character set, since the true number of symbols any given site accepts varies. Raw entropy is then `bits = length × log₂(poolSize)`, the same formula used by the Password Generator tool in this category. Four penalties are then applied on top of the raw score, each both subtracting bits and adding a named issue to the list shown beneath the result: fewer than 8 characters subtracts 20 bits ("Too short"); three or more identical characters in a row subtracts 10 bits ("Contains repeated characters"); any three consecutive characters that ascend or descend in sequence, like "abc", "789" or "cba", subtracts 10 bits ("Contains a sequential pattern"); and matching one of fifty extremely common leaked passwords subtracts 30 bits ("one of the most commonly used passwords"). The final score is clamped so it never goes below zero. The strength label then reads: under 28 bits "Very Weak", under 36 "Weak", under 60 "Fair", under 80 "Strong", 80 or above "Very Strong". The crack-time estimate assumes an attacker capable of 10,000,000,000 (ten billion) guesses per second — a documented, illustrative assumption representative of a fast offline attack against a weakly-hashed password list, shown as a caption beneath the estimate. Real crack time varies enormously depending on how a password is actually stored: a password hashed with a slow, salted algorithm (like bcrypt or Argon2) can be orders of magnitude harder to crack than the same password protected only by a fast, unsalted hash, even at identical bit-strength. The formula used is `seconds = 2^bits ÷ 10,000,000,000 ÷ 2` (dividing by two for the average case of finding the password partway through an exhaustive search), then bucketed into a human-readable range from "instantly" up through seconds, minutes, hours, days, years, and finally "centuries" for anything beyond about 3.15 billion seconds. Worked examples: "password" matches the common-password list exactly, scoring Very Weak regardless of its raw entropy. A random 16-character string mixing all four types, such as one generated by the Password Generator tool, typically scores 100+ bits with no issues flagged — Very Strong. "abcdefgh" is flagged for its sequential pattern but not for length, since exactly 8 characters is the minimum accepted length, not below it.