Nodebug .app
Log in

Tools · Security

Password checker.

Grade a password, see exactly what makes it weak, check whether it has shown up in a data breach, and generate a strong one.

Grading · zxcvbn strength estimator Breach data · Have I Been Pwned Privacy · Your password never leaves this tab

Check a password

Start typing to see a grade

  • At least 12 characters
  • An uppercase letter
  • A lowercase letter
  • A number
  • A symbol
  • No obvious patterns (repeats, sequences, keyboard runs, dates)
  • Not a common password

Has it been breached?

Checks the password against hundreds of millions of passwords leaked in real data breaches. Nothing is sent until you click.

Generate a password

How the breach check keeps your password private

Your browser turns the password into a SHA-1 hash and sends only the first 5 of its 40 characters to Have I Been Pwned. The service replies with every leaked hash that starts with those 5 characters (hundreds of them, padded with decoys), and your browser checks for a match itself. Have I Been Pwned never sees the password or even its full hash. This is the same method 1Password and Firefox use. The grading and the generator run entirely in this tab and use your browser's cryptographic random number generator.