Most password meters measure the wrong thing. They count character classes and reward you for adding a capital, a digit and a symbol, which is why Password1! scores well on a great many sites despite being one of the first combinations any attacker tries.
This checker measures entropy instead, and then looks for the patterns that entropy alone misses.
What entropy means here
Entropy is a measure of how many guesses it would take to find your password, expressed in bits. Each additional bit doubles that number. It is calculated from the size of the character set you have used and the length of the password.
Roughly: under 28 bits is trivially breakable, 40 bits is weak, 60 bits is reasonable for an ordinary account, 80 bits is strong, and beyond 100 bits you are past the point where offline cracking is a practical concern.
The crack-time estimate assumes ten billion guesses per second, which is a realistic figure for a determined attacker with modern graphics hardware working against a fast hash. It is a deliberately pessimistic assumption. A site using a slow hash such as bcrypt or Argon2 makes the attack orders of magnitude harder - but you cannot know which one a given site uses, so it is better to assume the worst.
Where the pattern checks come in
Entropy assumes randomness, and human-chosen passwords are not random. So the score is reduced when certain patterns appear:
A character repeated three or more times. Passwords made only of digits, particularly four-digit sequences that look like a year. Common words - password, qwerty, admin, letmein, welcome - anywhere in the string. Letters with no other character type at all.
These reductions matter because the raw entropy calculation would otherwise overrate a password like aaaaaaaaaaaa, which uses twelve characters from a 26-letter alphabet and scores well on arithmetic while being guessed almost immediately in practice.
How to read the result
The advice list under the meter is the useful part. It names what is missing or weak rather than just showing a colour. If it says the password looks strong, the arithmetic and the pattern checks both passed.
One caveat this checker shares with every other: it cannot tell whether your password has appeared in a breach. A password can be long, random-looking and score perfectly here while being in a public wordlist because it leaked from a site you used in 2019. To check that, use a service that queries breach databases with k-anonymity, such as Have I Been Pwned - it never receives your full password.
Typed here, and nowhere else
Everything happens in JavaScript on your machine. Nothing is transmitted, stored or logged, and there is no network request when you type. That is a requirement rather than a feature for a tool like this - a strength checker that sent passwords to a server would be a credential collector with a progress bar on it. Even so, testing a variation of a real password rather than the password itself is a sensible habit anywhere.