Password Strength Checker

Yes. The strength test runs entirely in your browser and your password is never stored. The breach check uses a privacy technique called k-anonymity: your browser turns the password into a SHA-1 hash and sends only the first 5 characters of that hash to Have I Been Pwned, which returns hundreds of possible matches. Your browser compares them locally, so neither we nor Have I Been Pwned ever see your password. You can also turn the breach check off.

We use zxcvbn, the open-source estimator created at Dropbox. Instead of just counting character types, it looks for what attackers actually try: common passwords, dictionary words, names, dates, keyboard patterns like qwerty, repeats and swaps like @ for a. It estimates how many guesses each piece would take, and we convert that into the time an attacker making 10 billion guesses per second would need.

Your exact password appears in Have I Been Pwned's collection of over a billion real passwords exposed in past breaches. It doesn't necessarily mean your account was hacked, since someone else may have used the same password. But attackers load these lists first, so a leaked password can be guessed almost instantly, no matter how complex it looks.

Stop using it. Change it on every account where you've used it, starting with email, banking and work accounts. Use a unique, randomly generated password for each one, store them in a password manager, and turn on multi-factor authentication.

Symbols don't help much when the rest of the password is predictable. Password1! and Summer2024$ follow patterns attackers know well. Length and randomness matter far more. Four or five random words beat a short password full of symbols.

Length, randomness and uniqueness. Aim for at least 15 characters or four random words, avoid anything personal or common, and never reuse it on another site.