Password strength and breach checker
Estimate real crack time, then check the password against known breaches without ever sending it.
Almost everything here is local. The optional breach check sends only the first five characters of the password's SHA-1 hash and compares the returned list here. The password never leaves this page.
How the breach check protects the password
Checking whether a password appears in a breach normally means telling somebody the password, which is obviously self-defeating. The method used here, called k-anonymity, avoids that entirely.
- Your browser computes the SHA-1 hash of the password locally.
- It sends only the first five characters of that hash — a prefix shared by hundreds of thousands of different passwords.
- The service returns every hash suffix it holds beginning with that prefix, often several hundred of them.
- Your browser compares your full hash against that list here, and the answer never goes back.
The service learns that somebody, somewhere, has a password whose hash starts with five particular characters. It cannot tell which of the hundreds you had, and it never sees the password. The count returned is how many times that exact password has appeared across known breach corpora.
What actually makes a password strong
Length beats complexity, by a long way
Every character you add multiplies the search space. Every substitution you make —
a to @, o to 0, an exclamation
mark on the end — adds almost nothing, because cracking tools have applied those
exact transformations to every dictionary word since the 1990s. P@ssw0rd!
satisfies most corporate complexity policies and falls in under a second.
Reuse is the real risk
Most accounts are not lost to guessing. They are lost because a password used somewhere else leaked, and someone tried the same pair everywhere — an attack called credential stuffing, and it is automated and cheap. A unique password per site turns one breach into one problem instead of twenty.
That is unmanageable by memory, which is the argument for a password manager: it lets every password be both long and unique because you never type any of them. Remember one strong passphrase for the manager itself and let it handle the rest.
Turn on two-factor authentication
A second factor makes a stolen password insufficient on its own. Prefer an authenticator app or a hardware key over SMS, since text messages can be redirected by porting your number — but SMS is still far better than nothing.
If a password of yours shows up in a breach
- Change it wherever you used it, email account first — that is the one that can reset all the others.
- Do not just add a digit to the end. Breach wordlists are used with mutation rules, and that is the first mutation tried.
- Turn on two-factor authentication while you are in the settings.
Common questions
Is it safe to type my password into this page?
The strength analysis is entirely local. The optional breach check uses k-anonymity: the password is hashed in your browser, only the first five characters of that hash are sent, and the matching happens here against the hundreds of hashes that come back. Nobody, including this site, can work out your password from that. Even so, if a password is already in a breach, the answer is to change it, not to test it repeatedly.
What actually makes a password strong?
Length and unpredictability, not punctuation. P@ssw0rd! satisfies every complexity rule and dies in under a second, because substituting @ for a is the first thing every cracking tool tries. Four random words beat a mangled dictionary word by an astronomical margin.
My password appears in a breach. What now?
Change it everywhere you used it, starting with email and banking, and turn on two-factor authentication. A breached password is not merely guessable. It is already sitting in the wordlists attackers try first.