Password Strength & Pwned Check

Local strength scoring plus optional k-anonymity breach range search. Password is never stored.

Local first · server only if you opt in

Strength details appear here. Clear the field when finished.

Use this check carefully

Use the local strength assessment first. If you request a breach lookup, a five-character SHA-1 prefix is sent to Have I Been Pwned and the returned range is matched in your browser.

Interpret the evidence

A match means that password appears in the provider’s corpus, not that your specific account was breached. No match is not proof of secrecy. Prefer a unique password and enable strong account authentication.