Pattern strength checker

How it works

Tap or drag across the 5×5 grid to draw a test pattern. As you draw, the checker first confirms Velcrypt’s minimum rules: one continuous line through at least six dots, with at least one change of direction. If the pattern doesn’t meet them, it’s rated Too short.

Once it passes, the checker gives a rough rating of Weak, Fair, Strong or Very strong, plus an approximate strength in bits. Everything runs in your browser. Nothing is saved, and nothing is sent anywhere.

What the checker looks at

A pattern’s strength is roughly how hard it would be for someone to guess it, given what people tend to draw. The checker combines several signals:

• Number of dots. More dots means more possible patterns.
• Direction changes. Each turn adds unpredictability compared with a straight line.
• Self-crossings. A line that crosses its own path is less common and harder to guess.
• Grid coverage. Patterns that span several rows and columns score higher than ones squeezed into one area.
• Corner start. Starting in a corner is very common, so it lowers the score slightly.
• Long straight runs. Sweeping along a whole row or column is easy to guess and easy to see over your shoulder.
• Simple shapes. Patterns that resemble an L, Z, S, U or a square are among the first anyone would try.

The bits figure is an estimate, not a measurement. It is a heuristic designed to nudge you away from common habits, not a guarantee of how long a pattern would resist a determined attacker.

Why human patterns are predictable

On paper, a 5×5 grid offers an enormous number of possible lines. In practice, people don’t pick at random. Research on the classic 3×3 phone pattern has repeatedly found strong biases: starting top-left, moving left to right and top to bottom, using few turns and drawing familiar letters. Those habits shrink the space an attacker realistically needs to search.

A strong pattern is one that avoids those habits while staying memorable to you. For a broader comparison of unlock methods, read pattern lock vs PIN vs Face ID.

Tips for a stronger pattern

1. Aim for 8–12 dots. That is Velcrypt’s recommendation: long enough to be hard to guess, short enough to remember.
2. Add two or more turns. Mix horizontal, vertical and diagonal moves.
3. Cross your own line once. It adds complexity without much effort to remember.
4. Start somewhere other than a corner. Middle or edge dots are less expected.
5. Use the whole grid. Touch at least three rows and three columns.
6. Avoid letters and shapes. Initials, L, Z, S, U and squares are early guesses.
7. Practise before you rely on it. Draw it several times so muscle memory takes over.

Never enter your real pattern

This checker doesn’t store or transmit anything, but the habit matters more than this one page. Never type or draw a real password, PIN or pattern into any website. Instead, draw a pattern with a similar style (similar length, number of turns, starting area) and use the result as guidance.

Strength is only part of the picture

In Velcrypt, your pattern is the key: encryption keys are derived from it with PBKDF2-HMAC-SHA512 using at least 600,000 iterations, which makes each guess slow. See encryption. Every pattern also opens its own vault, as explained in hidden vaults and pattern lock.

A strong pattern can’t protect against someone watching you draw it, a phone handed over with the vault open, or a forgotten pattern. In the first version there is no recovery, so read forgot your vault pattern before choosing something you might not remember.