With the rapid development of wearable biosensors and wireless communication technologies, various smart healthcare systems are proposed to monitor the health of patients in real time. However, many security problems exist in these systems. For example, a password guessing attack can compromise IoT devices, leading to invasion of health data privacy. After giving an overview of security threats of healthcare IoT, this article studies security vulnerabilities of password building and presents a password strength evaluation method that takes into account users' personal information.