Password Strength Checker

Assess the robustness of your passwords with this client-side strength checker. Get immediate feedback on how to improve your password security. Your password is not sent anywhere.

Strength: N/A

Optionally, check if this password has appeared in a data breach using the 'Have I Been Pwned?' service. Your password is never sent; only a part of its anonymous hash is used to check for matches.

This feature uses the k-Anonymity model to protect your privacy when interacting with the Have I Been Pwned API.

▸How to Use the Checker

Get a comprehensive analysis of your password's security in a few simple steps.

  • ❶
    Enter Your Password

    Type or paste your password into the input field. The analysis begins instantly as you type. Note that the input field is a password type, so what you type will be masked.

  • ❷
    Review Instant Feedback

    Observe the strength bar and the checklist below it. They update in real-time to show you the password's score and which security criteria it meets (like length, character variety, etc.).

  • ❸
    Check for Breaches (Optional)

    Once you've entered a password, click the "Check for Breaches" button. This will securely check if that password has appeared in any known data breaches, using the 'Have I Been Pwned?' service.

✦Key Features & Security

This tool is designed with your privacy and security as the top priority.

  • ◆
    100% Client-Side Analysis

    The core password strength analysis happens entirely in your browser. The password you enter is never sent to a server, ensuring it remains known only to you.

  • ◆
    Anonymous Breach Checking

    The 'Have I Been Pwned?' check uses a k-Anonymity model. This means your full password is not sent. Instead, only the first few characters of its SHA-1 hash are transmitted, preserving your privacy.

  • ▨
    Detailed, Actionable Feedback

    Don't just see a score; understand why. The checklist provides clear, actionable tips on how to improve your password, encouraging better security habits.

  • ✕
    No Storage, No Tracking

    This tool is stateless. It doesn't store, log, or track the passwords you enter. Once you leave the page, it's gone.

  • ◈
    Transparent & Open Source

    The entire codebase is public on GitHub. You can inspect every line of code to verify its security and see exactly how it functions. This transparency means you don't have to just trust it—you can check it. Contributions to fix bugs or suggest improvements are highly encouraged.

✦Beyond the Checkmarks: What is Password Entropy?

While checklists for length, numbers, and symbols are a good starting point, true password strength lies in its 'entropy'—a measure of its unpredictability. A password like 'P@ssword123!' might tick all the boxes but is predictable and therefore weak. In contrast, a password like 'correct horse battery staple' is much longer and far less predictable, giving it higher entropy.

This tool calculates an entropy score based on the password's length and the size of the character set used (lowercase, uppercase, numbers, symbols). The higher the entropy, the longer it would take a computer to guess it through brute force. The goal is to create a password that is not just complex, but truly random and unpredictable.

◈Frequently Asked Questions (FAQ)

Yes. The strength evaluation is performed by JavaScript running on your own computer. For the optional breach check, it uses a privacy-preserving technique where your actual password is never revealed to any server. The project is also open source, so you can verify the code yourself.

If the tool indicates your password was found in a breach, you should stop using it immediately. Change that password on any site where you have used it, and avoid using it in the future. Use a password generator to create a new, unique one.

It's a privacy model. Instead of sending your whole password hash to a server to ask 'is this pwned?', your browser sends just the first 5 characters of the hash and asks for a list of all pwned passwords that start with those same characters. The check is then completed locally on your machine. This way, the server never knows exactly which password you're checking.

Length is generally considered the most critical factor for password strength. A long, simple-to-remember passphrase (e.g., 'tree car blue sky') is often stronger and more secure than a short, complex one (e.g., 'Tr3e!') because the sheer number of possible combinations is vastly larger.