> For the complete documentation index, see [llms.txt](https://docs.leather.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.leather.io/wallet-and-security/leather-password-strength.md).

# How Leather Evaluates Password Strength

The two checks a Leather extension password must pass, and why a long password can still be rejected.

When you set a password in the Leather extension, it must pass two checks:

* It is at least 12 characters long.
* It gets the highest score, 4 out of 4, from [zxcvbn](https://github.com/dropbox/zxcvbn), a password strength estimator first published by Dropbox. Leather scores the first 100 characters.

## Why a long password can fail

zxcvbn estimates how many guesses an attacker would need. It knows common passwords, dictionary words, names, keyboard patterns such as `qwerty`, dates and common substitutions such as `0` for `o`. A password built from those parts scores low, however long it is.

For example, `Tr0ub4dor&3` mixes cases, digits and a symbol, but zxcvbn recognizes a dictionary word with substitutions and scores it low. A phrase of several unrelated random words is often both longer and stronger.

To see how a password scores, try it in a zxcvbn demo, never with the password you use.

## What the password protects

The password encrypts your Secret Key on this browser and unlocks Leather. It plays no part in creating your keys or addresses. All wallets in the extension share the same password.

If you forget the password, sign out of Leather and restore your wallets with their Secret Keys. You then set a new password. As long as you have your Secret Keys, a forgotten password does not cost you any assets.

A wallet that holds only a Ledger device needs no password, because the keys stay on the device.

## Related

* [Secure Your Secret Key](/wallet-and-security/secure-secret-key.md)
* [Lock and Unlock Wallet](/get-started/lock-and-unlock-wallet.md)