Check a password

Find out how strong a password is, and whether it has been leaked by a hacked website. Your password never leaves your device.

For the geeks: how secure is it?

Strength is measured on your device with zxcvbn, which spots common words, patterns and substitutions.

For the leak check, your device turns the password into a SHA-1 fingerprint and sends only its first 5 of 40 characters to Have I Been Pwned. It replies with every leaked fingerprint starting that way (hundreds of them), and your device looks for a match. This is called k-anonymity: neither they nor we can learn your password.

How it works

  1. 1Type a password. It stays on your device the whole time.
  2. 2See its strength. How long a hacker would take to guess it, with tips to make it stronger.
  3. 3See if it's been leaked. We check it against billions of passwords from hacked websites, without revealing it.

Questions

Is it safe to type my real password here?

Yes. The strength check runs on your device. For the leak check, only the first 5 characters of a scrambled fingerprint of it are sent, which matches hundreds of different passwords, so nobody can learn yours.

My password was found in a leak. What now?

Change it everywhere you use it, starting with your email and bank. Use a new, unique password for each site. pass.new makes strong ones instantly.

What makes a password strong?

Length matters most. 12 or more random characters, or a passphrase of 4 to 6 random words, is very hard to guess. Avoid names, dates and common words.