Skip to content

Pwned Passwords

Check if a password has appeared in a data breach. Your password is hashed with SHA-1 in your browser and only the first 5 characters of the hash are used for the lookup (k-anonymity).

Password strength analyser

Strength score: — (0/100)

Offline crack time estimate: —

  • At least 12 characters
  • Lowercase letters
  • Uppercase letters
  • Numbers
  • Symbols

How does this keep my password private?

The full password and full hash never leave your device. Only a 5-character SHA-1 prefix is sent; the matching suffix list is compared locally. Nothing is logged or stored.