🔒 Password Strength Checker

Has Your Password Been Breached?

Check password strength and see if it appeared in known data breaches. Uses k-anonymity - your actual password never leaves your browser.

Live strength meter
🔐 Your password is hashed in your browser. Only the first 5 characters of the SHA-1 hash are sent to HIBP (k-anonymity model).
🛡
Ready to test
Enter a password above and click “Check Password”
-
Score /4
💪
Password Strength & Entropy
Estimates entropy and crack time on a fast GPU cluster, discounting common words, keyboard runs, repeats and years
Pending ▼
Enter a password and run the check to see entropy analysis.
🔤
Character Set Analysis
Checks if your password uses lowercase, uppercase, numbers, and symbols
Pending ▼
Enter a password and run the check to see character analysis.
💥
Breach Database Check (HIBP)
Checks Have I Been Pwned - your password is never sent; only a 5-char SHA-1 prefix
Pending ▼
Enter a password and run the check to verify it against breach databases.

How We Protect Your Privacy

We use the k-anonymity model from Have I Been Pwned. Your password is SHA-1 hashed entirely in your browser. Only the first 5 characters of that hash are sent to HIBP. The API returns ~1000 matching hash suffixes, and we check locally if yours is in the list - the full hash and your actual password never leave your device.

If HIBP cannot be reached, or answers with something other than its hash list, the breach row says the check did not run, and the password is not called strong: a password is only “not breached” when the list came back and it was not on it. A password that is on the list is cracked instantly, whatever its length, because attackers try breached passwords first.

Password Best Practices

  • Use a password manager: Bitwarden, 1Password, or KeePass generate unique, strong passwords
  • 16+ characters: Length matters more than complexity
  • Passphrases: “correct-horse-battery-staple” is stronger than “P@ssw0rd”
  • Never reuse passwords across sites - one breach exposes all
  • Enable 2FA everywhere possible as a second layer of defense