Password Strength

Password Strength scores how hard a user's password would be to guess, at the moment they type it. The Keep Aware extension estimates the strength inside the browser and attaches the result to the login event, so you can find weak credentials on the accounts that matter without ever collecting the password itself.

Requirements

• Access to your Keep Aware console
• Keep Aware extension deployed to the Profiles you want visibility into

Password Strength is always on. There's no control to enable and no policy to create.

Getting started

Scoring happens automatically. To see the results, search login events and reference the two fields it produces:

1. Navigate to Search in the console.
2. Query type:login to see sign-in activity.
3. Add the Password strength and Password guess strength columns, or filter on input.score and input.guesses_log10 directly.

For example, type:login AND input.score:<=1 surfaces every sign-in where the password would fall to a rate-limited online guessing attack. For the full field list, see Event and threat fields.

Why password strength matters

Traditional password policies check composition — length, uppercase, a digit, a symbol. Those rules are easy to satisfy with a password that's still trivial to guess. Password1! passes most corporate composition policies and appears near the top of every breach corpus.

What actually matters is how many guesses an attacker needs. That depends on whether the password is built from things attackers already try first: common passwords, dictionary words, names, dates, keyboard runs, and predictable character substitutions. A composition rule can't see any of that.

How it works

Rather than scoring character classes, Keep Aware searches the password for the patterns attackers try first, then estimates the number of guesses needed to find it.

It matches against several pattern types:

• Dictionary — common passwords, English words, and common first and last names
• Reverse dictionary — the same words spelled backwards
• Character substitution — l33t-speak variants like p@ssw0rd
• Keyboard patterns — spatial runs like qwerty or 1qaz2wsx
• Repeats and sequences — aaaaaa, abcdef, 123456
• Dates — birthdays, years, and other date formats
• Regular expressions — recurring shapes such as a bare four-digit year

Each recognized pattern is cheap to guess, so it contributes little to the total. Whatever's left over is scored as if brute-forced. The result is an estimate of total guesses, reported two ways.

Password strength

Password strength (input.score) is an integer from 0 to 4, derived from the estimated guess count:

Password strength	Estimated guesses	What it means
0	Under 1,000	Too guessable. Falls to any attack.
1	Under 1 million	Very guessable. Protected only against a rate-limited online attack.
2	Under 100 million	Somewhat guessable. Protected against an online attack with no rate limiting.
3	Under 10 billion	Safely unguessable. Moderate protection if password hashes are stolen and cracked offline.
4	10 billion or more	Very unguessable. Strong protection against offline cracking.

Values of 0, 1, and 2 are the ones worth acting on. A 2 sounds middling but only means the password survives an attacker who can't crack hashes offline — which is not the scenario most breaches involve.

Password guess strength

Password guess strength (input.guesses_log10) is the base-10 logarithm of the same estimate, kept as a decimal. A value of 6 means roughly a million guesses; 10.5 means roughly 30 billion.

Use Password strength for reporting and thresholds, and Password guess strength when you want to rank or compare passwords that share a strength value. Two passwords can both sit at 2 while one takes a hundred times more work to guess than the other.

When scoring runs

Scoring runs in the browser each time a user leaves a password field that has something in it — on blur, before the form submits. Keep Aware scores fields the browser identifies as password fields, so it doesn't score usernames, search boxes, or ordinary text inputs.

Trust and data handling

Password Strength is designed so that estimating a password's strength never requires collecting the password.

• The password stays on the device. Scoring runs entirely inside the Keep Aware extension. The typed value passes from the page to the extension's own background worker, which runs the estimator locally and returns only the score and the guesses estimate. No network call is involved in scoring.
• The password isn't attached to the event. The score and the guesses estimate are the only password-derived values in the login event. Keep Aware doesn't put the typed password in the event body, and login events don't carry page content.
• The password isn't stored. Nothing is written to browser storage, disk, or logs.

Related detection

Password Strength answers "is this password weak?" It doesn't answer "has this user typed this password somewhere else?" That's Credential Reuse, a separate control with its own policy configuration and its own cryptographic handling.

The two work well together. Strength tells you which credentials are guessable; reuse tells you which credentials have spread. A password that is both weak and reused is the highest priority to rotate.

Use cases

Find weak passwords on your most sensitive applications

Report on sign-ins to a specific application where the password would fall quickly.

type:login AND location:"admin.company.com" AND input.score:<=1

Triage the weakest credentials first

A Password strength of 0 means under a thousand guesses. These are the accounts to rotate before anything else.

type:login AND input.score:0

Frequently asked questions

Question	Answer
Does Keep Aware see or store my users' passwords?	No. The estimator runs inside the extension on the device. Only the score and the guesses estimate leave it.
Do I need to turn this on?	No. Password Strength is always active wherever the extension is deployed.
Can I block a sign-in because the password is weak?	Not through this feature. Password Strength is a visibility signal on the login event. Use it for reporting and to target user education.
Does it work with password managers and autofill?	Yes. The value present in the field is scored regardless of how it got there. input.fill records which manager filled it.
Does it score every field a user types in?	No. Only fields the browser identifies as password fields.