The website considers
Gbt3fC79ZmMEFUFJ to be "weak" because of paragraph 2 on the same site: "Use a password that has at least... one special symbol." This example doesn't have a symbol, so the author says it's weak.
As others have pointed out,
Gbt3fC79ZmMEFUFJ should not be considered for no other reason than it's been published on the internet. That fact alone effectively drops its entropy to zero. And low entropy credentials are worthless. Now, if it weren't already published, it may be instructive to analyze it a bit, to see how much entropy it could have had.
That's max entropy, and
Gbt3fC79ZmMEFUFJ would only have that much entropy if:
- it contains no discernible patterns to be exploited by Hashcat
- it was produced by a bonafide random process
But let's look at the other extreme and pretend the password was created by any non-bonafide random process, as in, somebody just made it up in their head.
In a non-random process, prevailing wisdom suggests that entropy is much lower, as in about 2.3 bits per character (Shannon, 1950). That's a far cry from almost 6 bits! (In fact, newer analysis drops it down further to 1.1 bits per character, as published in 2016 by Takahira, et al.)
So, if we run with the presumption of 2.3 bits per character, total entropy for
Gbt3fC79ZmMEFUFJ would be about 37 bits (36.8), and take 59,823,779,182 guesses, on average, to discover. This is horribly weak, of course. Unless you know beyond a doubt a password was created randomly, you should presume it wasn't, and assign a lower entropy (2.3 bits) to each character.
But... it doesn't have any symbols, you say. Surely
Gbt3fC79ZmMEFUFJ would be much harder to crack if it had some of those special symbols. Would it? Let's see...
Gbt3fC79ZmME-*,J. The complexity of our 16-character password now jumps to 95, and keyspace is 9516 or 4.40 × 1031 permutations. Made randomly (having maximum chaos or entropy), the password's strength is of course stellar. Made non-randomly, it sucks. You see, adding the symbols
-*, didn't improve the fact that character entropy is still just 2.3 bits each, and total entropy would still be about 37 bits, and take 59,823,779,182 guesses, on average, to discover.
All that to say this, one cannot look at a password and "eyeball" it's strength—it must be analyzed. Entropy is not a function of the contents of the password, it's a function of the creation process itself.
To drive this point home consider that passwords created from a bonafide random process may also contain harmful patterns. The 12‑character term
q\UD73b9(Js^ is both 100% random and 100% worthless. It happens to match a very common topology pattern (lsuuddldsuls), and every password in the topology—all 11 quadrillion of them—will be butchered in under 9 hours!