Know how strong your password really is.
Test a password's strength, see if it has appeared in a known data breach, generate a strong new one, and find out whether your email has been leaked.
Check a passwordFree to use. Passwords never leave your browser.
Password Strength Checker
Checks character variety, real weak patterns (sequential runs, repeated characters, keyboard walks), and estimated entropy.
Checks this password against the "Have I Been Pwned" database of known breached passwords. Only the first 5 characters of a hash are sent — your actual password never leaves your browser. Requires an internet connection.
Password Generator
Create a strong password or an easy-to-remember passphrase. It's generated on your device and never sent anywhere.
Private by design. Passwords you check or generate stay on your device. Nothing is saved.
Has your email been in a data breach?
Enter an email address to see which known data breaches it has appeared in. The check is done by XposedOrNot, a free breach-lookup service. Your email is sent to them for the lookup and isn't stored by this site.
Your password is the front door to your accounts
Email, banking, social media and work accounts often depend on a single password. A weak or reused one is the easiest way in.
Billions leaked
Real passwords from past data breaches are public, and attackers try them first.
Cracked in seconds
Short or common passwords like "password123" fall almost instantly to automated guessing.
One leak, many accounts
Reuse a password and a single breach can unlock every account that shares it.
Weak and strong passwords, side by side
Length matters more than complexity. A long, random phrase is far harder to crack than a short word dressed up with symbols.
| Example | Rating | Why |
|---|---|---|
password1 | Weak | One of the most leaked passwords in the world |
qwerty123 | Weak | Keyboard pattern followed by a number run |
Sarah1997! | Weak | A name and birth year are easy to guess |
Maple-River-Jacket-42 | Strong | Long passphrase of unrelated words |
t7#Kq!m2Vz9@Lp | Strong | Random and 14 characters long |
Six habits that keep your accounts safe
A strong password is the start. These habits close the gaps attackers use most.
Make it long
Use at least 12 characters, ideally 16 or more. Four random words make a passphrase that is long and easy to remember.
Use a different password everywhere
If one site is breached, attackers try the same email and password on banks, email and social media.
Let a password manager do the work
It creates and remembers a unique password for every account, so you only need to remember one.
Turn on two-factor authentication
An authenticator app or security key stops an attacker even if your password leaks.
Don't log in from links
Phishing emails and texts copy real login pages. Type the site's address yourself instead.
Act quickly after a breach
When a service you use is breached, change that password, and any others that match it, right away.
If your password was leaked
Work through these steps in order. Most accounts can be secured in under an hour.
Change the password now
Start with your email account, since it can reset every other password.
Replace it everywhere you reused it
Give each account its own new, unique password.
Turn on two-factor authentication
Choose an authenticator app or security key over text messages where you can.
Review recent activity
Look for unfamiliar logins, devices, forwarding rules or payments, and sign out other sessions.
Watch your financial accounts
Set up alerts with your bank, and consider a credit freeze if personal details were exposed.
Common questions
Is it safe to type my password here?
Yes. The strength check and password generator run entirely in your browser. For the breach check, your password is turned into a hash and only the first 5 characters of that hash are sent to Have I Been Pwned, so your actual password never leaves your device. Nothing is stored.
How does the breach check work?
It uses Have I Been Pwned's k-anonymity method. The service returns every leaked hash that starts with the same 5 characters, and your browser looks for a match locally.
What happens to my email when I check it?
Your email address is sent to XposedOrNot, a free breach-lookup service, which replies with the breaches it appears in. This site doesn't store it or send it anywhere else.
Are generated passwords safe to use?
Yes. They're created on your device using your browser's secure random number generator and are never sent or saved. Store them in a password manager so you don't have to remember them.
What is entropy?
Entropy estimates how unpredictable a password is, measured in bits. Each extra bit doubles the number of guesses needed to crack it. Aim for 70 bits or more.
What makes a password strong?
Length, randomness and uniqueness. Use 12–16 or more characters, avoid names, dates and keyboard patterns, and never use the same password on two sites.
Should I change my passwords regularly?
Not on a fixed schedule. Current guidance is to change a password when there's a reason, such as a breach, and to focus on making each one long and unique.