How each check works

1What leaves your device

Your password never leaves the page. For the breach check, your browser makes a SHA-1 hash of the password and sends the first 5 of its 40 characters to our server. Our server asks the Pwned Passwords range API for every hash starting with those 5 characters, with padding on, and passes the list back. Your browser looks for the rest of the hash in that list. Our server never sees the password, the full hash or the result, and our code keeps nothing.

The estimate and the generator run entirely in your browser. Tests on every release read every request the page makes, and fail if a request holds anything more than those 5 characters.

2Known breaches

Source: Have I Been Pwned, Pwned Passwords. Fail: this exact password is on the list. Pass: it is not. Could not check: the list could not be reached, and this row is not counted. Cannot see: passwords stolen but not published, and whether your own account was affected.

3Length

Fail: under 8 characters. Check: 8 to 14. Pass: 15 or more. Why these figures: see the table of official advice.

4Guess estimate

From the open-source zxcvbn library (version 4.4.2), which models how many guesses a tool would need, trying common passwords, words, names, dates and keyboard patterns first. Fail: under 1 million guesses, the top of zxcvbn's "very guessable" band. Check: under 10¹⁵. Pass: 10¹⁵ or more, which is about a day at the fast-hash rate below. This Pass line is our own choice, and stricter than zxcvbn's own top band of 10 billion, which that rate clears in one second.

Its word lists are mostly US data, so we add common names, places and words from India, Ireland, New Zealand, Australia, Canada, the UK and the US. This list is ours and is not complete, so a local word it does not hold can look more random than it is.

The time table uses two example rates: 100 guesses an hour (a site that limits attempts) and 10 billion guesses a second (a stolen file with a fast hash). A real attack can be faster or slower. Only the first 128 characters go into the estimate.

Generated passwords. zxcvbn does not know a passphrase came from a known list, and can put it far too high: about 6 × 10³⁰ guesses for one 5-word example, against about 2.8 × 10¹⁹ real possibilities. When you press "Check this one", we show the true figure from the generator in place of the estimate. If you edit the password, it is treated as your own and goes back to the estimate. A passphrase you made elsewhere cannot be told apart, so read its estimate with care.

5Patterns

The parts of the password zxcvbn recognised. Check: patterns found and the estimate is under 10¹⁵. Pass: none found, or the estimate is 10¹⁵ or more. The password's own text shows here only after you press Show.

6The generator

Random picks come from your browser's cryptographic source (crypto.getRandomValues), with rejection sampling so that no choice is more likely than another. The bits figure is worked out from the list and the options you chose. For a random password, we count the strings that hold at least one character from each set you ticked, so the figure is exact. Tests check an even spread over a large sample.

7What this site cannot tell you

• Whether you use the password on other sites.
• Whether a site you use stores it well.
• Whether your device has malware that reads what you type. If you suspect that, do not type real passwords on it anywhere.