Security Tools

Password Strength Checker

Check how strong a password is and whether it has appeared in a data breach. It runs in your browser, and your password is never sent.

No password yet

Data breach check

We'll check your password against billions of leaked passwords.

Checklist

  • 12+ characters
  • Uppercase letter
  • Lowercase letter
  • Number
  • Symbol

How to improve it

  • Use at least 16 random characters, or 5+ random words.
  • Use a different password for every account.
Generate a strong password Free, and generated in your browser.

Think you've been hacked?

Our digital forensics team traces how attackers got in and what they accessed, removes malware and backdoors, then hardens your servers so it doesn't happen again.

Start a forensics investigation

A free tool by Neu Notion. More free tools.

Your password never leaves your browser. Only anonymous usage counts are sent to Neu Notion.

Breach data from Have I Been Pwned (CC BY 4.0). Strength estimate by zxcvbn.

How this password checker works

The strength rating uses zxcvbn, an open-source estimator that recognizes common passwords, dictionary words, names, dates, keyboard patterns and letter-for-symbol swaps. Crack times assume an attacker making 10 billion guesses per second.

The breach check uses the Have I Been Pwned database of passwords exposed in real data breaches. Your password is hashed on your device, and only the first 5 characters of the hash are sent. The service returns every leaked hash that starts with those characters, and the match is checked in your browser, so neither we nor Have I Been Pwned can see your password.

Is it safe to type my real password here?

Yes. The strength check runs entirely in your browser. For the breach check, your password is turned into a SHA-1 hash on your device and only the first 5 characters of that hash are sent. The full password and full hash never leave your browser.

What should I do if my password was found in a breach?

Stop using it. Change it on every account where you used it, starting with email and banking, and turn on multi-factor authentication. Attackers try leaked passwords on other sites automatically.

Why does a password like P@ssw0rd! score as weak?

Attackers' tools know common words and the usual substitutions (@ for a, 0 for o, ! at the end). Length and randomness matter far more than swapping letters for symbols.

What makes a password strong?

At least 16 random characters, or a passphrase of 5 or more random words, used for one account only. The easiest way to get one is a password generator plus a password manager.