Use this on your own accounts or your organization's own data — for example, a password-manager export, or a policy audit of your team's credentials. Never run passwords you don't have authorization to test.
Paste or Upload Passwords
One password per line, or a CSV with a password column (an optional username column is picked up automatically). Analysis runs the moment you click Analyze — nothing is uploaded anywhere.
Privacy
How this stays private
Every password is analyzed locally using the same zxcvbn library and 10,000-entry common-password list used on the rest of this site — nothing is uploaded, logged, or transmitted, and closing or refreshing this tab discards everything. The optional "Check all against Have I Been Pwned" button sends only a partial SHA-1 hash per password (k-anonymity — see how it works), one at a time with a short pause between requests, and only runs if you click it.
Sources & Standards
Where this tool's guidance comes from
This tool's defaults and recommendations are built on the following official, internationally recognized standards and guidance — not opinion. Each link goes directly to the source.
Have I Been Pwned
Pwned Passwords (k-Anonymity API)
The breach-password database and privacy-preserving lookup model this tool's optional breach check is built on.
haveibeenpwned.com →
NIST
SP 800-63B-4 — Digital Identity Guidelines
Requires screening new passwords against known-breached and commonly-used lists — the basis for auditing passwords in bulk.
csrc.nist.gov →
OWASP
Credential Stuffing Prevention Cheat Sheet
Guidance on why reused and breached credentials are the top vector in account-takeover attacks, and how to defend against it.
cheatsheetseries.owasp.org →
NCSC (UK)
Password Administration for System Owners
Official UK government guidance on auditing and enforcing password policy across an organization's accounts.
ncsc.gov.uk →