Password Strength Checker

Paste a password to get detailed strength analysis and breach detection.
100% Client-Side No Data Sent to Server No Rate Limits No Signup Required

Latest Articles

View all

Frequently Asked Questions

Is my password sent to any server?
No. All strength analysis happens locally in your browser. For the breach check, only the first 5 characters of the SHA-1 hash are sent (k-anonymity), so your full password is never transmitted.
What is password entropy?
Entropy measures the randomness of a password in bits. Higher entropy means more possible combinations and a stronger password. A password with 80+ bits of entropy is considered very strong.
How does the breach check work?
We use the Have I Been Pwned API with k-anonymity. Your password is hashed with SHA-1, and only the first 5 characters of the hash are sent to the API. The API returns all matching hashes, and the comparison happens locally in your browser.
What is a good crack time?
A password that would take centuries or millennia to crack at 10 billion guesses per second is considered very strong. Anything under a year is weak by modern standards.
What patterns does it detect?
The checker looks for sequential characters (abc, 123), repeated characters (aaa), keyboard patterns (qwerty), common substitutions (p@ssw0rd), and dictionary words.