🔒 Password Strength Checker

Has Your Password Been Breached?

Check password strength and see if it appeared in known data breaches. Uses k-anonymity - your actual password never leaves your browser.

Live strength meter
🔐 Your password is hashed in your browser. Only the first 5 characters of the SHA-1 hash are sent to HIBP (k-anonymity model).
🛡
Ready to test
Enter a password above and click “Check Password”
-
Score /4
💪
Password Strength & Entropy
Calculates bit-entropy and estimates crack time on a fast GPU cluster
Pending ▼
Enter a password and run the check to see entropy analysis.
🔤
Character Set Analysis
Checks if your password uses lowercase, uppercase, numbers, and symbols
Pending ▼
Enter a password and run the check to see character analysis.
💥
Breach Database Check (HIBP)
Checks Have I Been Pwned - your password is never sent; only a 5-char SHA-1 prefix
Pending ▼
Enter a password and run the check to verify it against breach databases.

How We Protect Your Privacy

We use the k-anonymity model from Have I Been Pwned. Your password is SHA-1 hashed entirely in your browser. Only the first 5 characters of that hash are sent to HIBP. The API returns ~1000 matching hash suffixes, and we check locally if yours is in the list - the full hash and your actual password never leave your device.

Password Best Practices

  • Use a password manager: Bitwarden, 1Password, or KeePass generate unique, strong passwords
  • 16+ characters: Length matters more than complexity
  • Passphrases: “correct-horse-battery-staple” is stronger than “P@ssw0rd”
  • Never reuse passwords across sites - one breach exposes all
  • Enable 2FA everywhere possible as a second layer of defense