How strength is measured
Most strength meters just check for a capital letter, a number and a symbol, which rates
Password1! as strong. Real attackers don't guess like that: they try common passwords,
dictionary words, names, dates, keyboard patterns like qwerty and swaps like
p@ssw0rd first.
This checker uses zxcvbn-ts, which looks for those same patterns, including tens of thousands of common passwords and popular English words, names and surnames. It estimates how many guesses a password would take, scores it from 0 to 4, and tells you what's weak about it.
What the crack times mean
The times assume an attacker who knows these tricks. An online attack guesses through a login page, which is slow, especially when the site limits attempts. A stolen database lets an attacker guess offline as fast as their hardware allows; how fast depends on how well the site stored passwords. Aim for a password that holds up in the "fast hashing" row, because you can't know how a site stores yours.
Is it safe to type my password here?
The check runs entirely in your browser; the password is never sent anywhere or stored. Even so, the safest habit is to test passwords that are similar to yours rather than the real thing. For a strong password you don't have to think up, use the password generator.