All tools
// tool 01

Password Checker

See how strong a password really is, how long it would take to crack, and whether it has already leaked in a data breach.

Your password never leaves this device
—

Tip: never type your real passwords into websites you don't trust — test similar ones instead.

Data breach check

Checked against the Have I Been Pwned list of passwords exposed in real data breaches.

Checklist

  • At least 12 characters
  • Lowercase letters
  • Uppercase letters
  • Numbers
  • Symbols or spaces
  • No repeated characters (aaa)
  • No sequences (abc, 123, qwerty)
  • Not a common word or password

How long would it take to crack?

It depends on how the attacker gets to it. Estimates are based on the number of guesses a smart attacker would need (calculated with zxcvbn).

How the breach check keeps your password private

  1. 1
    Your browser hashes the password with SHA-1 —
  2. 2
    Only the first 5 characters of the hash are sent to the server —
  3. 3
    The server returns every leaked hash that starts with them — plus random padding —
  4. 4
    Your browser looks for the rest of the hash in that list, locally —

This technique is called k-anonymity: the server never learns your password — not even its full hash — because hundreds of different passwords share the same 5-character prefix.