Password Security Tools
Analyse any password for strength, entropy, crack resistance, and data-breach exposure. All tools run entirely in your browser — passwords are never sent to our servers.
Which Tool Do I Need?
| I want to… | Use this tool |
|---|---|
| Test the overall strength of a password | Password Strength Checker |
| Calculate exact entropy in bits with pool breakdown | Password Entropy Calculator |
| See crack time estimates across different attack types | Crack Time Calculator |
| Check if a password appeared in a data breach | Password Leak Checker |
All Security Analysis Tools
Password Strength Checker
Real-time strength analysis — entropy, crack time, character composition, and specific weakness detection. Results appear as you type.
- Strength level (Very Weak → Very Strong)
- Entropy in bits
- Crack time table (5 scenarios)
- Weakness & positive detection
Password Entropy Calculator
Calculate exact entropy in bits with a full breakdown of character pool contributions. See what removing each character type costs you.
- Entropy formula displayed: length × log₂(pool)
- Pool size breakdown by character type
- Entropy impact table (remove each type)
- Reference entropy table
Crack Time Calculator
Detailed crack time estimates across five attack scenarios — from a throttled online login to a high-speed GPU cracking cluster.
- Online throttled (10/s)
- Online unthrottled (10k/s)
- Offline bcrypt (10k/s)
- Offline SHA-256 (10B/s)
- GPU cluster (10T/s)
Password Leak Checker
Check if a password has appeared in known data breaches. Uses HaveIBeenPwned k-Anonymity API — only a partial hash is sent, never the password.
- 10 billion+ breached passwords
- k-Anonymity model — password never transmitted
- Shows breach count if found
- Actionable advice if compromised
Privacy by Design
Strength analysis is fully local
The strength checker, entropy calculator, and crack time calculator run 100% in your browser's JavaScript engine. No network requests are made. Your password never leaves your device.
Leak checker uses k-Anonymity
Only the first 5 hex characters of your SHA-1 hash are sent to the HaveIBeenPwned API — 1 in over 1 million possible values. The server cannot determine which password you're checking.
No logging, no storage
We have no server-side logging of passwords or analysis results. The tools have no account system and no backend that could store or process your input.