We use cookies to understand how the site is used and to display ads. Analytics and advertising only run after you accept. You can change your choice anytime via the footer link or your browser settings. Privacy policy

Skip to content
>_devvkit

Password Strength Checker

Score passwords with zxcvbn and check for known breaches via HIBP.

—
Have I Been Pwnedtype 8+ characters to check

Uses k-anonymity — only the first 5 characters of the SHA-1 hash are sent to the HIBP API; the full hash and password never leave your browser.

//Share this tool
//Related tools
JSON Formatter
Format, validate, minify, and prettify JSON data instantly.
JWT Decoder
Decode and inspect JWT tokens: header, payload, signature, expiration.
Base64 Encoder/Decoder
Encode text or files to Base64 and decode back. UTF-8 safe.
Regex Tester
Test regular expressions in real-time with match highlighting and groups.

Score passwords with zxcvbn, the entropy-based strength estimator used by Dropbox and GitHub. Check against the Have I Been Pwned breach corpus with k-anonymity — the full password never leaves your browser.

[x]Features
  • -zxcvbn entropy scoring with crack-time estimates
  • -Live score meter and actionable suggestions
  • -Breach check via HIBP k-anonymity (SHA-1 prefix only)
  • -Minimum length enforcement (8+ characters)
  • -Graceful offline handling when the API is unreachable
  • -Sample passphrase for instant demo
>Use Cases
  • >Evaluating passwords before committing to them
  • >Auditing password policies for your team
  • >Deciding whether a reused password is safe
  • >Teaching what makes a password strong

Frequently Asked Questions

>Is my password sent to a server??
For strength scoring, no — zxcvbn runs locally. For the breach check, only the first 5 characters of the SHA-1 hash are sent to the HIBP API (k-anonymity), never the password itself.
>What is zxcvbn??
A password strength estimator that models how attackers actually guess passwords: dictionary words, common patterns, sequences, and keyboard walks. It also provides suggestions to improve your password.
>What does "pwned" mean??
The password appears in the Have I Been Pwned breach corpus — it has been exposed in a known data breach and should not be reused, even if it scores strongly.