Password Strength & Breach Checker
MAG212 CYBER · Tools
Password strength & breach checker.
See how long a password would hold up against real attacks, and check whether it has already appeared in a data breach — without the password ever leaving your device.
Check a password
Type a password to begin
Has it been in a data breach?
Checks the password against Have I Been Pwned’s database of passwords exposed in known breaches. Only the first 5 characters of the password’s SHA-1 hash are sent.
🔒 Strength is calculated in your browser. Nothing you type is stored or sent, except the anonymous 5-character hash prefix when you press Check breaches. Need a strong one? Use the password generator.
How the breach check stays private
- Your browser computes the SHA-1 hash of the password locally, e.g.
5BAA61E4C9B93F3F… - Only the first five characters (
5BAA6) are sent to Pwned Passwords. - The service returns every breached hash that starts with those characters — hundreds of them.
- Your browser looks for a match locally. The service never learns your password or even which hash you were checking. This technique is called k-anonymity.
Strong password habits
- Length beats complexity. A four-to-six word passphrase is stronger and easier to remember than
P@ssw0rd!. - Never reuse passwords. When one site is breached, attackers try the same email and password everywhere else (credential stuffing).
- Use a password manager to generate and store a unique password for every account.
- Turn on multi-factor authentication, ideally passkeys or an authenticator app, for email, banking and work accounts.
- Follow NIST SP 800-63B: no forced periodic changes, but change immediately if a password appears in a breach.
Need expert help?
MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.