This is a password strength checker that runs entirely in your browser. Nothing you type is uploaded, logged or sent to a model. The tool analyses what you enter, explains why it scored the way it did, and can generate a passphrase when you need a new one.
It is free, it needs no account, and it works on the page below.
What it checks
Three separate questions, answered in the same place.
- How strong is this password? Entropy is calculated, then adjusted for the patterns that make a long password weak. Repeats, sequences, keyboard walks and common substitutions all cost you.
- How long would it survive? Crack time is estimated under three realistic scenarios: an online attack with throttling, a slow hash, and a fast hash. One number would mislead you, so you get three.
- Has it appeared in a breach? An optional check compares a five character hash prefix against the Have I Been Pwned range API. The comparison happens locally. The full hash never leaves your machine.
What happens to what you type
Everything runs in the tab you are looking at. Open your browser network panel while typing and you will see no request. That is the point of a client side tool, and it is worth verifying rather than trusting.
There are three boundaries worth knowing:
- Raw passwords are never sent to WordPress, to an external API, to analytics, or to server logs.
- History is off by default. If you switch it on, only derived scores and timestamps are stored in your own browser storage. The password itself is never stored.
- The breach check is the one feature that touches the network, and only when you press it. Even then, only a five character prefix travels.
Generating a passphrase
The generator uses the browser crypto API, not a random number function with a predictable seed. Words come from the BIP-0039 list of 2,048 terms, and selection uses unbiased rejection sampling so no word is favoured.
You can build a passphrase of several words, or a character password with your own symbol and length rules. Copy is a single click, and the value is cleared from memory when you move on.
Exports
Reports can be saved as PDF, HTML, DOCX or plain text. Every export runs through an allowlist that strips credential fields before the file is written. If you export a report and search it for the password you typed, you should find nothing.
That behaviour is deliberate. A report is a record of a decision, not a copy of the secret.
Limits you should know
- A strength estimate is an estimate. It models attack cost, not the attacker in front of you.
- No breach result is proof of safety. A password absent from a known breach list can still be weak or reused.
- The tool does not store or sync anything across devices. That is a privacy decision, not a missing feature.
- It runs in your browser, so it needs JavaScript. Without it you get a message, not a broken form.
Questions
Is my password sent anywhere?
No. Analysis, scoring, generation and export all run in your browser memory. The only network request is the optional breach check, and it carries a five character hash prefix, not your password.
Do I need an account?
No. There is no login, no email capture before use, and no paywall. The tool is open to anyone on this page.
Why three crack time estimates?
Because one figure hides the assumptions. An online attack with rate limits behaves nothing like an offline attack against a stolen fast hash. Showing three scenarios tells you which risk you are actually exposed to.
How does the breach check work without exposing the hash?
Your browser hashes the password, keeps the first five characters, and sends only that prefix. The service returns every hash in that range. The matching happens on your machine, and the full hash is discarded.
Can I use this on a shared computer?
Yes, with one habit: do not enable history on a shared machine. With history off, nothing persists after you close the tab.
Where does this fit in the rest of the site?
The tool was built with the same workflow the paid engine runs. If you want the process behind it, the case study documents the scope, the tests and the limits. If you want the workflow itself, start with the SOVEL Copilot Engine.