All tools

Password Strength Checker

Check password strength safely: the test runs on your device and nothing is sent anywhere.

  • Runs on your device
  • No watermark
  • Free, no signup needed
  • Available offline

Has this password appeared in a data breach?

Optional, and only when you press the button. Your password never leaves this device: it is turned into a SHA-1 fingerprint here and only the first 5 of its 40 characters are sent to Have I Been Pwned. The list of matching fingerprints comes back and is compared on your device.

Strength

How to use it

  1. Type a password.
  2. See its score, estimated crack time and warnings.
  3. Optionally check it against known breaches, then follow the suggestions.

Questions

Is it safe to type my real password?

The strength check runs in your browser and nothing is transmitted. The breach check is optional and sends only 5 characters of a fingerprint, never the password. Even so, security experts recommend testing a similar password rather than one you use.

How is strength measured?

With zxcvbn, the open-source estimator created at Dropbox. It looks for dictionary words, names, dates, keyboard patterns and common substitutions, not just length.

What makes a password strong?

Length and unpredictability. Several random words, or 16 or more random characters, beat a short word with symbols swapped in (like P@ssw0rd), which crackers try early.

Does my password get sent to Have I Been Pwned?

No. Your browser turns the password into a SHA-1 fingerprint on your device and sends only the first 5 of its 40 characters to the Pwned Passwords service. Hundreds of unrelated fingerprints share those 5 characters; the list comes back with extra padding entries, and the match is checked on your device. This is the k-anonymity method published by Have I Been Pwned. Nothing is sent until you press the button.

Keep exploring In-Right

Independent reviews and buying guides for the gear behind the task.

Software & Utilities reviews

More free tools

Strong Password GeneratorGenerate strong, random passwords and memorable passphrases on your own device with cryptographic randomness. Set length and characters. Never sent anywhere.Hash Generator & Checksum CheckerGenerate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, and verify a download against its published checksum. Free, in your browser.Base64 Encoder & DecoderEncode and decode Base64 online, plus URL encoding, HTML entities and JWT decoding. Unicode-safe and private: your data never leaves your browser. Free.Password Breach CheckerCheck if a password has been leaked in a data breach without sending it. Only 5 characters of its SHA-1 fingerprint leave your device (Have I Been Pwned).Username GeneratorGenerate random usernames for games, social media and new accounts: friendly word-based names or pronounceable random ones. Make a list in one click. Private.Passphrase GeneratorGenerate a strong, memorable passphrase from random words on the EFF long word list (Diceware), made on your device with secure randomness. Easy to type.

All tools

move open closeAll tools