A password, that contains:

  • at least one capital letter,
  • at least one small letter,
  • at least one number and
  • at least one non-alphanumeric character,

is considered moderate to strong (sometimes even very strong) on all systems, that I've been using so far... except Wordpress, where it is considered very weak. What am I missing here?

If this is a very weak password, then what rules should it match to be considered strong or very strong, by a person, who created password strength meter in Wordpress.org Network system?

  • 1
    If it helps, you can satisfy the WP password strength scale by mixing the character types up a bit. Starting with a capital letter and ending with a symbol is a very human pattern. Try switching that up a little and you'll see your "strong" result return.
    – jdm2112
    Apr 2 '15 at 19:14
  • 1
    The strength meter uses zxcvbn. You can find an explanation of how it works here.
    – Milo
    Apr 2 '15 at 19:16
  • What is a Wordpress.org Network system? A multisite?
    – fuxia
    Apr 2 '15 at 19:29
  • @jdm2112 Actually switching capital letter with non-alpha character (begin with end) resulted in again very weak password.
    – trejder
    Apr 2 '15 at 20:09

The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012.

The library is available for free on Github: https://github.com/dropbox/zxcvbn

An explanation of the library is here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/

But the short version is that it analyzes patterns in the password instead of being a simple "does it have caps" and "does it have a symbol" method.

For example, a password of "Passw0rd123!" is not a good password by modern standards. It uses a dictionary word, it uses common leet-speak replacements, it starts with a capital letter, it ends in a symbol, and it includes a whole number which is a common pattern of sequential digits. It's a human pattern, and modern password cracking systems are geared to specifically crack exactly that kind of password.

The zxcvbn library ("zxcvbn" is an example of a bad password) includes a list of common passwords, a common English dictionary, and many methods designed to recognize these patterns, as well as other patterns such as common keyboard patterns (Examples: "wasd" = connected letters, often used by gamers, while "951357" is the the shape of an X on a numeric keypad). These sorts of things are then all ranked and a score is formed.

Modern passwords have to be basically complete gibberish, or long phrases, not simple patterns. Anything less is usually insecure to modern password cracker programs.

Try what you think a "good" password is in the Javascript demo. It might prove enlightening:


  • Thanks for a great answer. However, there is a slight glitch. The password, that I'm usually using is considered as strong by Wordpress / Dropbox checker. While it turned out to be so weak, that I wasn't able to continue registration on Samsung side. I begin to think, if we're generally to falling into some kind of paranoia. How can the same password be considered strong by one checker and to weak to continue, by another one?
    – trejder
    Apr 2 '15 at 20:15
  • 1
    Because different checks use different mechanisms. There is no standard definition of "password strength". Most of the checks are simply invented by the programmer at the time. Also, you should not use the same password on two different sites.
    – Otto
    Apr 4 '15 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.