It calculates 18 quintillion years because howsecureismypassword.net is simplistic and doesn't realize english words are being used. It categorizes each charact

It calculates 18 quintillion years because howsecureismypassword.net is simplistic and doesn't realize english words are being used. It categorizes each character into some categories (see https://howsecureismypassword.net/assets/js/app.min.js https://howsecureismypassword.net/assets/js/app.min.js): // Standard ASCII Characters add('ASCII Lowercase', /[a-z]/, 26); add('ASCII Uppercase', /[A-Z]/, 26); add('ASCII Numbers', /\d/, 10); add('ASCII Top Row Symbols', /[!@£#\$%\^&\*\(\)\-_=\+]/, 15); add('ASCII Other Symbols', /[\?\/\.>\,<`~\\|"';:\]\}\[\{\s]/, 19); [...] It sees the password is 22 characters long, and contains a-z chars (lowercase) and a space char (other symbols) so it estimates each char is drawn from a set of 26+19 = 45 letters. And it assumes the default bruteforcing speed is 4 billion passwords per second. So: 45**22/4e9/3600/24/365.25 = ~18 quintillion years.