Password Security Checker
Two checks in one: strength against brute-force cracking, and whether it's shown up in a known breach. Both run privately in your browser.
Crack-time estimate
See realistically how long a password would take to break.
Breach database check
Checked against known, publicly disclosed breaches.
100% private
Your password is never sent anywhere in full.
Improvement tips
Concrete suggestions, not just a pass/fail score.
1. Strength check
100% client-side — your password is never sent anywhere or stored.
2. Breach check
Why two different checks?
A password can be long and complex and still be a bad choice — if it's already sitting in a breach database from some other site, its strength score is irrelevant; attackers try known-breached passwords first, before any brute-force attempt. Strength and breach status are two separate questions, and a password needs to pass both to actually be safe.
The strength check estimates how long a brute-force attack would take based on length, character variety, and common patterns — entirely client-side, nothing is ever sent anywhere. The breach check uses k-anonymity: your password is hashed in your browser, and only the first 5 characters of that hash are sent to check against hundreds of millions of real, publicly disclosed breach records. The full password, and even the full hash, never leaves your device either way.
Frequently asked questions
Do I need to run both checks, or is one enough?
Both — a password can score well on strength and still be compromised if it's been breached elsewhere, and a never-breached password can still be short enough to guess quickly. They catch different failure modes.
Does checking my password here store or log it anywhere?
No. The strength check never leaves your browser at all, and the breach check only ever transmits a 5-character hash prefix — never the password itself, and never the full hash.
My password passed both checks — is it safe to reuse across sites?
No — even a strong, never-breached password becomes risky the moment it's reused, because a breach at any one site exposes it for credential-stuffing attacks against every other account using the same password.
Related tools
Email Breach Checker
Check if your email was exposed in known data breaches.
Email Security Checker
Check SPF and DMARC records to prevent email spoofing.
JWT Decoder & Analyzer
Decode JWTs and flag alg:none, missing expiry & other issues — 100% client-side.
Technology Detector
Detect CMS, Framework, CDN, Server & Analytics