A local Password Strength Checker reviews the length and obvious pattern structure of a candidate Microsoft 365 password entirely in your browser, returning a five-level label that aligns with current NIST SP 800-63B guidance. Empty input scores zero, fewer than eight Unicode code points is Weak, eight through fourteen is Fair (capped at Fair when a simple repeated or sequential pattern is detected), fifteen through nineteen code points scores Good for a non-patterned value, and twenty or more code points scores Strong. The meter does not contact any server, does not check a breach corpus, and does not estimate entropy in bits — it only reports the documented length and pattern checks. This makes it a safe pre-flight pass before you submit a new sign-in secret through the Microsoft 365 sign-in screen, the Entra ID portal, or your tenant's password-change flow, because the candidate value never leaves the page you typed it on.
What Microsoft 365 (and Entra ID) actually verify when you submit a password
Office 365 and Microsoft 365 are now governed by the Entra ID (formerly Azure Active Directory) identity platform. When a user changes or sets a sign-in secret, the service applies a baseline protection policy that currently enforces a minimum of eight characters, rejects obvious complexity patterns, and checks the value against a server-side blocklist of common, expected and previously leaked passwords. Tenant administrators can raise the floor further through a custom password-protection policy, lock out banned words specific to their organization, and require multi-factor authentication for sensitive roles.
Two things the end user usually does not see are the actual blocklist check and any administrative fine-tuning. The Microsoft 365 sign-in form will accept a value, then either accept it, return a vague "your password doesn't meet the complexity requirements" error, or signal that the value has appeared in a known breach. There is no live strength bar, no preview score, and no explanation of which rule the candidate secret tripped. A pre-flight review on a local page closes that gap: you can read the documented length band, the descriptive character-group count, and the pattern flag, and decide whether the secret is worth submitting at all.
What a local password complexity check can and cannot see
The Password Strength Checker counts Unicode code points — so an emoji such as 🦊 is one code point rather than two UTF-16 units — and reports the broad character groups present: lowercase letters, uppercase letters, digits, symbols, whitespace and non-ASCII characters. It then flags two narrow, explainable pattern shapes: a chunk of up to four code points repeated three or more times, and a run of four code points increasing or decreasing by one in code-point order.
It deliberately does not advertise entropy in bits, because NIST notes that estimating entropy for user-chosen secrets is unreliable. It does not download a breach database, does not send a partial hash anywhere, and does not pretend to know whether your chosen value appears in a leaked corpus. A "No pattern" line is therefore not a clean bill of health: it only means those two specific checks did not fire. Real attackers use leaked-password corpuses, dictionaries, service-specific words, keyboard walks, personal facts and probabilistic models rather than brute-forcing every character combination, so the local meter is guidance for choosing a better secret, not certification.
Check your Office 365 candidate password in five steps
- Open the Password Strength Checker in your browser. The page is static and runs locally; you do not need to sign in or grant any permission, and the candidate value never leaves the tab.
- Type or paste the candidate secret into the input field. The field is masked by default and remains hidden until you press the Show button, so shoulder-surfers and screen recorders see only dots while you work.
- Read the length counter in code points and the descriptive character-group line. The line tells you which broad groups appear (lowercase, uppercase, digits, symbols, whitespace, non-ASCII) but does not require any specific group — composition rules are intentionally absent because forced substitutions tend to be predictable.
- Inspect the pattern row. A "No pattern" result means the meter did not find a short repeated chunk or a four-character monotonic run; a flagged result means the score has been capped at Fair regardless of length, because predictable structure dominates length in real attacks.
- Treat the five-level label (Empty, Weak, Fair, Good, Strong) as a starting point, not a guarantee. Submit the value through your Microsoft 365 sign-in page only after you have generated it with a password manager, verified the target service accepts the characters, and enabled multi-factor authentication on the account.
Score thresholds in plain English
The label boundaries are documented and consistent across the page, so you can predict them in advance. The thresholds are feedback rules, not a claim that every long string is safe; they exist to nudge short and predictable values upward toward a length that current guidance treats as workable when combined with other controls.
| Label | Length in code points | Pattern rule |
|---|---|---|
| Empty | 0 | Always |
| Weak | 1–7 | Always |
| Fair | 8–14 | Capped at Fair if a simple repeated or sequential pattern is detected |
| Good | 15–19 | Only when no simple pattern is detected |
| Strong | 20 or more | Only when no simple pattern is detected |
The 15-character boundary matters for Microsoft 365 in particular. Entra ID's baseline protection currently enforces a minimum of eight characters, but NIST treats anything shorter than fifteen as weak when the password is the only factor. A candidate that lands in the Good or Strong band on the local meter lines up with the length band that the broader guidance recommends, and combined with MFA that length is usually sufficient for a non-administrative account.
Patterns the meter flags — and patterns it cannot see
The pattern detector is intentionally narrow. It finds a short chunk of up to four code points repeated at least three times (so abcabcabc flags, as does aaaa), or a run of four code points that increases or decreases by one (so 1234 and dcba flag). It cannot recognize every keyboard walk such as qwerty, popular quotes, song lyrics, names, dates, language dictionary words, or any value that has appeared in a real breach corpus.
If your candidate is a sentence you can speak aloud, the meter will treat it as long and non-patterned, which is the desirable result for a passphrase strategy. It is still up to you, the password manager's generator, and the account provider's full blocklist check to make sure the value has not been leaked elsewhere. A practical workflow is to generate a random secret locally, paste it into the Password Strength Checker for a sanity check, then submit it through the Microsoft 365 sign-in page and immediately enable MFA on the account.
Beyond the local score: layered protection for a Microsoft 365 account
A clean "Strong" label is a floor, not a ceiling. Microsoft 365 tenants should pair the local review with three further controls, all of which line up with the OWASP Authentication Cheat Sheet: a password manager that generates and stores a different random secret for every service; multi-factor authentication (preferably phishing-resistant through a passkey or FIDO2 hardware key rather than SMS); and the tenant's own breach or blocklist warning surfaced in the Entra ID sign-in flow. Service operators, in turn, are responsible for storing the hash with a suitable salted password-hashing function rather than a fast SHA variant or reversible encryption.
If you want a fresh random secret before you run the local check, the local password generation guide walks through a browser-only workflow that does not require cloud sync. Change a Microsoft 365 password when it is reused, exposed, or suspected compromised — not on an arbitrary calendar — and treat any local score as one signal among several rather than a guarantee.