How to use
- Type a password.
- Read the strength and suggestions.
- Optionally check it against known breaches.
Questions
Is my password sent anywhere?
No. The strength check runs in your browser. The breach check sends only the first 5 characters of the password’s SHA-1 hash to Have I Been Pwned, and compares the results on your device, so the password itself never leaves it.
How is the crack time worked out?
It assumes an attacker with a copy of a leaked password database, trying about 10 billion guesses a second. Common passwords and patterns are guessed first, so they count as much weaker.
What makes a strong password?
Length and randomness. A password manager’s random password, or four or more random words, is best.