Password Leak & Strength Check
See whether a password has shown up in known data breaches and how well it would hold up against guessing. Your password is never sent to us.
Strength is estimated in your browser. For the leak check, your browser hashes the password and sends only the first 5 characters of the hash.
Password generator
Generated in your browser with a cryptographic random source. Nothing is stored or sent.
How the leak check stays private
Your browser computes the SHA-1 hash of the password locally and sends only its first 5 characters to a relay on this site, which asks the Pwned Passwords range service for every hash starting with those 5 characters. The comparison happens back in your browser. The password and its full hash never leave your device, and the upstream service never sees your IP address.
What this check cannot tell you
The strength figure is a heuristic estimate, not a guarantee, and passphrases made of ordinary words can look stronger than they are. A password absent from known breaches may still be weak, and no check can tell whether a site stores your password safely. Use a unique password per account and turn on two-factor authentication.
Want to understand VPN protection?
Compare provider profiles using official sources and independent audits.