LegitInformant

Password strength and breach checker

Estimate real crack time, then check the password against known breaches without ever sending it.

Almost everything here is local. The optional breach check sends only the first five characters of the password's SHA-1 hash and compares the returned list here. The password never leaves this page.

The strength analysis runs as you type and never leaves this page. The breach check is separate, optional, and sends only the first five characters of a hash — never the password.

How the breach check protects the password

Checking whether a password appears in a breach normally means telling somebody the password, which is obviously self-defeating. The method used here, called k-anonymity, avoids that entirely.

  1. Your browser computes the SHA-1 hash of the password locally.
  2. It sends only the first five characters of that hash — a prefix shared by hundreds of thousands of different passwords.
  3. The service returns every hash suffix it holds beginning with that prefix, often several hundred of them.
  4. Your browser compares your full hash against that list here, and the answer never goes back.

The service learns that somebody, somewhere, has a password whose hash starts with five particular characters. It cannot tell which of the hundreds you had, and it never sees the password. The count returned is how many times that exact password has appeared across known breach corpora.

What actually makes a password strong

Length beats complexity, by a long way

Every character you add multiplies the search space. Every substitution you make — a to @, o to 0, an exclamation mark on the end — adds almost nothing, because cracking tools have applied those exact transformations to every dictionary word since the 1990s. P@ssw0rd! satisfies most corporate complexity policies and falls in under a second.

Reuse is the real risk

Most accounts are not lost to guessing. They are lost because a password used somewhere else leaked, and someone tried the same pair everywhere — an attack called credential stuffing, and it is automated and cheap. A unique password per site turns one breach into one problem instead of twenty.

That is unmanageable by memory, which is the argument for a password manager: it lets every password be both long and unique because you never type any of them. Remember one strong passphrase for the manager itself and let it handle the rest.

Turn on two-factor authentication

A second factor makes a stolen password insufficient on its own. Prefer an authenticator app or a hardware key over SMS, since text messages can be redirected by porting your number — but SMS is still far better than nothing.

If a password of yours shows up in a breach

  • Change it wherever you used it, email account first — that is the one that can reset all the others.
  • Do not just add a digit to the end. Breach wordlists are used with mutation rules, and that is the first mutation tried.
  • Turn on two-factor authentication while you are in the settings.

Common questions

Is it safe to type my password into this page?

The strength analysis is entirely local. The optional breach check uses k-anonymity: the password is hashed in your browser, only the first five characters of that hash are sent, and the matching happens here against the hundreds of hashes that come back. Nobody, including this site, can work out your password from that. Even so, if a password is already in a breach, the answer is to change it, not to test it repeatedly.

What actually makes a password strong?

Length and unpredictability, not punctuation. P@ssw0rd! satisfies every complexity rule and dies in under a second, because substituting @ for a is the first thing every cracking tool tries. Four random words beat a mangled dictionary word by an astronomical margin.

My password appears in a breach. What now?

Change it everywhere you used it, starting with email and banking, and turn on two-factor authentication. A breached password is not merely guessable. It is already sitting in the wordlists attackers try first.

These tools check form, not honesty. A valid checksum, a passing SPF record or a decoded link tells you something is well formed — never that the person behind it is telling the truth. When money is involved, verify on a phone number you already had, and run the link or address through the full check as well.