// TOOLS

Security Tools

🛡️ Password Strength

It does not count requirements: it measures real entropy, discounting what an attacker already knows —keyboard patterns, l33t swaps, dates, sequences— and checks whether your password appears in known breaches.

🔒
It never leaves your browser. The analysis is local. The breach check uses Have I Been Pwned k-anonymity model: only the first 5 characters of the SHA-1 hash are sent, never the password.
Type a password

Frequently asked questions

Is my password sent anywhere?
No. Strength is computed in your browser. The Have I Been Pwned check uses k-anonymity: only the first 5 characters of the SHA-1 hash ever leave the browser, never the password.
Why is "P@ssw0rd123" rated weak if it meets the requirements?
Because it measures real entropy, not checkboxes: it discounts the patterns an attacker tries first (l33t substitutions, common words, sequences, dates). Having an uppercase, a digit and a symbol does not make it strong.
What do the crack times mean?
They estimate how long an attack would take in three scenarios (rate-limited online, a bcrypt hash, a GPU farm). They give a realistic idea, not a guarantee.