Password Strength and Breach Check

What it does

Three things that answer different questions. It estimates how much entropy a candidate password actually has, after discounting the patterns that cracking tools exploit. It checks the candidate against the Have I Been Pwned corpus of breached passwords without sending the password anywhere. And it generates replacements, either as a random passphrase or as a random character string.

The entropy figure is turned into times to guess under three attack models — an online endpoint that rate-limits you, an offline attack against a slow hash, and an offline attack against an unsalted fast hash on GPUs. Those numbers span about fifteen orders of magnitude for the same password, which is the point.

How the breach check keeps the password private

This is the part worth understanding, because “type your password into a website” is normally terrible advice.

Your browser computes the SHA-1 hash of the password locally with crypto.subtle.digest. It then sends the first five hex characters of that hash and nothing else. The Pwned Passwords range API returns every hash suffix in the corpus that begins with those five characters — roughly 800 of them — and your browser searches that list for the remaining 35 characters. The comparison happens in the tab. This is the k-anonymity scheme described in the HIBP API documentation, and it means the server sees one of 1,048,576 possible prefixes and cannot tell which of the ~800 matching passwords you were asking about.

Our edge function is a thin proxy that exists only so the request carries a consistent user agent and the add-padding header, which pads every response to the same size. It receives the same five characters and stores nothing.

SHA-1 is used because that is what the corpus is keyed on. It is broken for collision resistance, which matters for certificates, and irrelevant here — this is an index lookup, and preimage resistance still holds. It says nothing about how you should store passwords, which is bcrypt, scrypt, or Argon2.

Why the strength number is smaller than you expect

A naive estimator multiplies length by the log of the character-set size and calls P@ssw0rd! a 59-bit password. Real cracking software does not enumerate the character space; it runs word lists through mangling rules. Capitalise the first letter, append a year, swap a for @, add a trailing ! — a standard ruleset has tens of thousands of these, and it applies all of them to every entry in a list of hundreds of millions of leaked passwords before it ever tries a random string.

So this tool discounts what those rules generate for free: keyboard and alphabet runs, characters repeated in a row, a whole password that is one short unit repeated, four digits that look like a year, and the capital-word-digits-symbol shape that composition policies reliably produce. If the input reduces to a commonly leaked password after undoing substitutions, the estimate is capped at roughly the rank of that password in the list, because that is genuinely how many guesses it costs. If the input reads as three or more dictionary words, it is modelled as a word-list attack instead of a character attack.

The result is a heuristic. It is deliberately pessimistic, and the useful signal is the order of magnitude, not the second digit.

When to reach for it

Reach for it when you are picking a password you have to memorise — the one that unlocks the password manager, the disk, the SSH key — and you want a sanity check before committing. Reach for it when you suspect a credential has been in a breach and want confirmation before doing a rotation. Reach for it when someone proposes a password policy and you want a concrete demonstration that Winter2025! satisfies every composition rule and is worth about seventeen bits.

Do not paste a live production credential into any web page, including this one. The decoding is local, but clipboard history, browser extensions, and shoulders are not. Check a candidate before you adopt it, not a secret you are already using.

And note what NIST SP 800-63B §5.1.1 actually recommends, since it is the opposite of most corporate policy: a minimum length of 8 with a maximum of at least 64, no composition rules, no mandatory expiry, and a mandatory check against a breach corpus — which is exactly the check on this page.

Related tools

• Hash generator to compute the SHA-1 prefix yourself.
• JWT decoder for the HS256 secrets that need the same treatment.
• UUID generator when you need a random identifier rather than a secret.
• Base64 encoder/decoder for encoding a generated secret into config.
• HTTP header inspector for the rest of a security review.