Estimated in your browser
The password is broken into patterns: common passwords, dictionary words, dates, keyboard rows, words typed in the wrong layout. These determine how many guesses an attacker would need.
Password strength and leak check
Type a password to see how strong it is and how long it would take to crack. One click checks whether it appeared in known data breaches, using the Have I Been Pwned database. Your password never leaves your browser.
The strength estimate runs in your browser. The leak check sends only the first 5 characters of the SHA-1 hash. The password itself is never sent to us or anyone else.
How it works
Two checks, and the password is never transmitted: strength is estimated in your browser, and the leak check uses k-anonymity.
Checked by 5 hash characters
On click, the browser computes SHA-1 and sends only the first 5 characters to Have I Been Pwned. The match against the response happens on your device.
Nothing is stored
The password lives only in the open tab. It never reaches the page URL, logs or analytics, and session recording is disabled for the field.
What makes a password strong
Length
Every character multiplies the number of options. A 20-character phrase beats a short password full of symbols.
Unpredictability
Names, dates, words and keyboard rows are tried first. Truly random words and characters can't be guessed that way.
Uniqueness
A password used on several sites only needs to be stolen once. A separate password per site removes that risk.
More LiMP tools
Free network, privacy and security checks right in your browser — no install, no sign-up.
Length vs. complexity
Password strength depends on how many options an attacker has to try. Length grows that number fastest: each extra character multiplies it many times over. Predictable substitutions (@ for a, 0 for o) add almost nothing, because cracking tools apply them automatically.
That's why “Pa$$w0rd” is weak even though it ticks every box on a sign-up form, while four random words are strong even in lowercase.
Passphrases
A passphrase is a few random words in a row, like “cloud-spoon-bridge-notebook”. It's easy to remember and type on a phone, and as strong as a long random password. The words must be picked by a generator, not by you: quotes, song lyrics and meaningful sentences are cracked far faster.
Password managers
Nobody can remember dozens of unique passwords, and you don't have to. A password manager stores them encrypted and fills them in, so you only remember one master password, and a passphrase is a good fit for it. Together with two-factor authentication this stops most account takeovers.
What to do if your password was found in a breach
- Change it on every site where you use it, starting with email: it's the key to resetting your other accounts.
- Make the new password unique, not a variation like “password2” instead of “password1”.
- Turn on two-factor authentication wherever it's available.
- Review active sessions and connected devices in your account settings.
Password check FAQ
Your password is not sent to our servers: strength is computed in your browser, and the leak check sends only the first 5 characters of its SHA-1 hash to Have I Been Pwned. The field is excluded from session recording and never appears in the page URL or logs. Still, it's safer to test the same pattern with a few characters changed rather than a live password.
A way to check a password against a database without revealing it. Your browser hashes the password and sends only the first 5 characters. The service returns every hash with that prefix, usually several hundred, and your device finds the match. The service learns neither the password nor its full hash.
That's how many times the password appeared in public breaches collected by Have I Been Pwned. Even one hit means it's in cracking wordlists and will be tried early. Change it everywhere you use it.
Not being in a breach doesn't make a password strong: a short or predictable one can be guessed without any leak. Look at the strength estimate, and if you reuse the password across sites, switch to unique ones.
We estimate how many guesses it would take, accounting for common passwords, dictionaries, dates, keyboard rows and layout swaps. Then we divide by the guessing speed: about 100 attempts per hour through a login form, and about 10 billion per second if a database with fast hashes leaks. It's a guide, not an exact forecast.
The generator creates a new random password. Here you can test a password you came up with yourself, or a corporate password policy pattern. If it turns out weak, the generator is the quickest way to get a new one.
Not here: we don't accept email addresses. You can see which breaches your email appeared in at haveibeenpwned.com. It's an external service, and you enter your address directly on their site.