Pattern strength checker

How it works, and your privacy

The grid follows Bunker's own rules. Dots are numbered row by row, the order you draw them in matters, and a dot can't be used twice. If a straight line passes over a dot you haven't used, that dot is added for you, so you can't skip one by drawing past it. You can pass over a dot you've already used. Any unused dot can come next, including a jump like a chess knight's.

The checker then looks at what makes patterns easy to guess: how many dots, how many turns, where you started, whether the shape matches one people often draw, and whether any move jumps between dots that aren't in a line. It also tells you what Bunker itself would say when you create a vault: it needs at least 6 dots and one turn, refuses a built-in list of the most common shapes, and shows Fair, Good or Strong.

All of this runs in your browser. The page makes no network requests, sets no cookies and stores nothing. The pattern is gone when you clear the grid or close the tab.

Why human patterns cluster

A 3×3 grid like Android's already allows 389,112 patterns, and a 5×5 grid allows vastly more. People use very few of them. Studies of Android patterns found the same habits again and again: start in a corner, usually the top-left; move to the next dot over; turn as little as possible; draw a letter, often an initial. Someone guessing tries those first. That is why this checker describes guessability in words rather than quoting bits of entropy: a number based on every possible pattern would say a Z is as strong as a random scribble.

Smudges and glances matter too. A pattern is easier to watch over a shoulder than a passphrase, and a simple shape is easier to remember after one look.

The Pattern is only one part

In Bunker the Pattern doesn't unlock a stored copy of itself. It goes through slow key derivation (Argon2id) to make the key that decrypts your vault, so every guess costs real time on the device. The first 4 tries that open nothing are free. After the 5th, Bunker makes you wait 30 seconds before the next try, then 1 minute, then 5 minutes, then 15 minutes after each further miss, and quitting the app or changing the clock doesn't reset it. Those waits are a speed bump; the cost per guess is the protection. A Pattern that's hard to guess still matters most when someone has your device in hand. Read more in Pattern encryption and Security.

One limit to keep in mind: someone who has your unlocked phone and knows your Pattern sees everything in that vault. And if you forget your Pattern, only your Recovery Phrase (or a Passphrase you set on that device) gets you back in; we can't recover it for you.

Related

• Hidden Vaults: each Pattern opens its own vault, and nothing shows how many exist
• Duress Vault
• More free tools