Is your password strong, and has it leaked?

Two checks in one. First, how long a password would actually take to crack, estimated from its length, character mix and the patterns crackers try first. Second, whether that exact password already appears in known data breaches, checked without ever sending it anywhere. Type a password to test, or one close to the pattern you use. It is analysed entirely on this page.

Your password never leaves your device. Breach check uses k-anonymity.

Step 01 · Strength

Test a password

Strength updates as you type. It is estimated from length and character mix, then checked against the patterns crackers try first: words, years, trailing symbols, repeats and sequences. Nothing is sent for this part. Use a throwaway close to your real pattern if you would rather not type the real one.

Strength—

Entropy

—

Length

—

Crack time*

—

* Crack time assumes an offline attacker testing about 100 billion guesses per second against a fast, unsalted hash, the realistic worst case if a service stored your password badly. A properly salted, slow hash like bcrypt or Argon2 buys far more time, which is exactly why how a site stores passwords matters as much as the password itself. See Hash Lab for what that looks like under the hood.

Step 02 · Email exposure

Has your email been in a breach?

Honest answer on the mechanics: a privacy-respecting page in your browser cannot check an email against a breach database. Have I Been Pwned only allows email lookups through a keyed server API, on purpose, so the lookup is not abused. Any free page that instantly returns your email's breach history is routing it through a server, often while collecting the address. So this tool does not pretend to. Two real options:

Check it yourself

Free

Have I Been Pwned is the canonical source, run by Troy Hunt. Enter your email there directly. It is the one place worth typing it into, and it is free.

Open Have I Been Pwned ↗

Monitor it continuously

Automated

A one-time check is a snapshot. Dark-web monitoring services watch your email, passwords, and identity against new breaches and alert you when something surfaces. Compared honestly below.

Compare monitoring tools →

Step 03 · Fix it

What to actually do next

A breached or weak password has one fix: stop reusing it, and let a manager generate and remember long random ones so strength stops being your problem. If your identity is already exposed, layer monitoring and protection on top. These are the comparisons I keep current.

Password managers

Start here

The single highest-leverage move: unique, generated passwords everywhere, so a breach of one site can never cascade. My current ranking on security, UX, and value.

Top password managers 2026 →

1Password alternatives

Comparison

Already on 1Password and weighing a switch, or pricing it against the field? The head-to-head on the credible alternatives and who each one is for.

Alternatives to 1Password →

Identity-theft protection

If exposed

When your data is already out, these services combine monitoring, recovery help, and insurance. What each actually covers, ranked.

Identity protection 2026 →

Antivirus & anti-malware

Device side

Stolen passwords often start with malware on the device. Bitdefender, Norton, and the rest, compared on protection, performance, and price.

Antivirus 2026 →

How this works: the strength check runs fully in your browser. The breach check hashes your password with SHA-1 locally and sends only the first five characters of that hash to Have I Been Pwned's free Pwned Passwords API, which returns every matching suffix so the comparison finishes on your device. Your password, and the full hash, never leave this page. Some links in Step 03 are affiliate links; they never change the rankings.

Built client-side, like the rest of the free tools. For the bigger picture, read the research hub or browse the writing archive.