Password Strength, Leak Check & Generator
Measure password strength (entropy and estimated crack time), check whether a password has appeared in a data breach via Have I Been Pwned, and generate strong passwords. Strength and generation run entirely in your browser; the leak check never sends the password itself.
Check strength
How this works: only when you press the button, your browser hashes the password with SHA-1 and sends just the first 5 characters of the hash to Have I Been Pwned. Matching also happens in your browser, so the password and the full hash are never sent, and nothing goes through this site's server. HIBP receives those 5 characters and your IP address.
For passwords you already use, checking them in your password manager or your browser's built-in checker is safer. How to check if your password was leaked / Are password managers safe?
Generate a strong password
How to use
- 1
Type a password above to see its entropy (bits), strength, and estimated crack time.
- 2
Press “Check against breach data” to see whether that password appears in Have I Been Pwned's Pwned Passwords.
- 3
Use the generator below to create and copy a strong password by length and character set.
- 4
For important accounts, use a long generated password + a password manager + multi-factor auth.
Why it matters
FAQ
QIs my password sent anywhere?
The password itself is never sent. Strength and generation run entirely in your browser. Only when you press the leak-check button are the first 5 characters of its hash sent to Have I Been Pwned (see the next question).
QHow accurate is the 'crack time'?
It varies hugely with attacker hardware and hashing, so it's only a guide. We assume a fast offline brute force (~10 billion guesses/sec). Entropy (bits) is the more objective metric.
QHow does the leak check work, and is it safe?
It uses k-anonymity. Your browser hashes the password with SHA-1 and sends only the first 5 characters; Have I Been Pwned returns the several hundred hashes that start with them, and your browser looks for a match locally. Neither HIBP nor this site learns which password you checked. HIBP receives the 5 characters and your IP address. You can see the request in your browser's developer tools (Network tab).
QIf it says “not found”, is the password safe?
Not necessarily. Only breach data that has circulated is included. A short password or a common word pattern can still be guessed even if it was never leaked. Look at the strength result too, and use a different long password for every site.