Find out whether a password is strong and whether it has appeared in a known data breach. Everything runs in your browser -- your password is never sent to our server or logged anywhere.
Your password is processed entirely in your browser. Only the first 5 characters of a SHA-1 hash are sent to the Have I Been Pwned API to check for breaches. The full password and full hash never leave your device.
This tool uses zxcvbn, an open-source library developed by Dropbox that estimates how easy a password would be to crack, rather than applying arbitrary rules about uppercase letters or symbols. It checks for dictionary words, common patterns, keyboard sequences and personal data substitutions, and gives a realistic estimate of how long an attacker would need to crack the password offline.
The estimated crack time shown assumes an offline attack using a slow hashing algorithm. Real-world speed varies with hardware and hash type, but the figure gives a consistent basis for comparison between passwords.
The breach check queries the Have I Been Pwned Pwned Passwords database, which contains over 900 million password hashes collected from real data breaches. A k-anonymity model is used so that your password is never revealed to the API -- see the FAQ below for a full explanation.
If a password appears in the breach database, it means attackers already have that exact password in their cracking dictionaries. Even a long, seemingly complex password that has appeared in a breach should be treated as compromised and changed immediately on every account where it is used.
No. Your password never leaves your browser. The strength check runs entirely in JavaScript on your device. The breach check uses a technique called k-anonymity: only the first five characters of a SHA-1 hash are sent to the Have I Been Pwned API, and the matching is done locally. The full password and full hash are never transmitted anywhere.
K-anonymity is a privacy technique that lets you check whether a password appears in a breach database without revealing the password itself. Your browser converts your password to a SHA-1 hash, then sends only the first five characters of that hash to the Have I Been Pwned API. The API returns all hash suffixes that begin with those five characters -- typically several hundred -- and your browser checks whether the rest of your hash appears in that list. The API never receives enough information to identify your password.
The NCSC no longer recommends routine periodic password changes. Changing a strong, uncompromised password tends to produce weaker replacements because people run out of memorable variations. Change a password if it appears in a breach, if you suspect unauthorised access, or if you have shared it with someone who should no longer have access. Focus on making passwords long and unique in the first place, and use a password manager to maintain them.
Length matters more than complexity. A random four-word passphrase is typically stronger than a short string of mixed characters, because it is harder to crack by brute force and easier to remember. Avoid dictionary words used alone, common substitutions (@ for a, 3 for e), keyboard patterns, and personal information such as names, dates of birth or postcodes. Each account should have a unique password so that a breach at one service cannot compromise others.
Change the password immediately on every account where it is used. If you have reused it across multiple accounts, change it on all of them. Use a password manager such as Bitwarden or 1Password to generate and store a unique password for every account going forward.
For businesses, weak and reused passwords are one of the most common causes of account compromise. Cyber Essentials certification requires evidence that your organisation has a strong password policy in place, covering minimum length, unique passwords per system and multi-factor authentication where appropriate.
Our Cyber Essentials certification service covers your entire password and access control policy, not just a single password. It is the UK government-backed standard that demonstrates your business takes cybersecurity seriously.
Learn About Cyber EssentialsAlso free: our Website & Email Security Checker, Phishing Awareness Quiz and Cyber Essentials Readiness Self-Assessment -- no signup required for any of them.