Password strength checker
What we noticed
NIST SP 800-63B-4 checks
Checked on your device. The breach check sends only 5 characters of a hash.
See how hard a password is to guess, what makes it weak, and whether it has appeared in a data breach.
How the estimate works
A password you made up cannot be judged by its length and character types alone. Attackers do not try every combination in order; they start with leaked password lists, dictionary words with capitals and digits added, keyboard runs like qwerty, dates, and repeated chunks. This checker looks for those same shortcuts and reports the weakest reading.
- It compares the password, and a version with common swaps such as @ for a and 0 for o undone, against the 10,000 most common passwords.
- It looks for keyboard rows, alphabet and number runs, years, and repeats.
- It finds dictionary words and charges them as one choice from a list instead of as random letters.
The result is an estimate. A password that scores well here can still be weak if it is personal to you, such as a pet's name and a birthday. A password from the generator needs no estimate: its strength is known exactly.
The breach check
The optional breach check asks Have I Been Pwned whether the password appears in its corpus of passwords exposed in real breaches. It uses a method called k-anonymity: your browser hashes the password with SHA-1, sends only the first 5 characters of the hash, and receives every hash suffix that starts with them. The match is found on your device. The service never sees the password or even its full hash. Responses are padded so their size does not give the answer away.
NIST SP 800-63B-4 requires sites to compare new passwords against a blocklist of commonly used, expected or compromised values. This is the same kind of check, done by you. Read more in how to check whether a password was leaked.
Questions
Is it safe to type my real password here?
The strength estimate never leaves your device, and the page makes no request when you type. The breach check sends only a 5 character hash prefix. Even so, the safest habit is to check a password you are about to use, not one guarding an account today. If a password is weak, replace it rather than test variations of it.
Why does my long password score lower than I expected?
Usually because it is built from dictionary words, a name or a date. Cracking tools try combinations of words with common substitutions long before random strings, so a sentence you chose is weaker than its length suggests. Random words from the passphrase generator do not have this problem.
It says not found in breaches. Is it safe?
Not necessarily. Not being in a breach list only means it has not been exposed yet. A short or patterned password can be guessed whether or not it has leaked.
What do the NIST checks mean?
They test the two length rules in SP 800-63B-4, published 31 July 2025: at least 15 characters when the password is the only factor, and at least 8 when it is used with a second factor, plus whether it is on a common-password list.
Sources
- Pwned Passwords API documentation, Have I Been Pwned. Checked 18 October 2026.
- Validating Leaked Passwords with k-Anonymity, Cloudflare. Checked 18 October 2026.
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.