'badpassword' 10 days
'bad1password' 37 years
'bad password' 546 years
'bad 1password' 333 thousand years
'bad password 1' 18 million years
'bad 123password' a billion years
As with all password checkers, there are problems here.
But password security is much more about using bcrypt or scrypt (in case someone gets your database) and having timeouts and lockouts on password entry (to prevent brute-forcing through public channels).
Comments
Some tests:
As with all password checkers, there are problems here.If you want a password checker, this one is still the best I've seen: http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htm... (it correctly identifies all my above examples as terrible passwords)
But password security is much more about using bcrypt or scrypt (in case someone gets your database) and having timeouts and lockouts on password entry (to prevent brute-forcing through public channels).