About this tool
This password auditor checks password strength locally and queries the Have I Been Pwned breach database using the k-anonymity range API.
Privacy: Only the first 5 characters of the SHA-1 hash are sent to HIBP. Your actual password is never transmitted. The tool performs all local analysis in your browser.
Frequently asked questions
What is k-anonymity?
K-anonymity means your password is never sent to the server. Only the first 5 characters of its SHA-1 hash are sent, and the server returns all hashes that start with those 5 characters. Your browser then checks locally if the full hash is in the list.
Why does it say "Not found in any known breach"?
This means the password (or exactly the same password) has not appeared in any breach that HIBP has collected. However, this does NOT mean the password is safe if it is weak.
What if the API request fails?
Network issues or rate limiting could cause the breach check to fail. The tool will show a message in this case but still provide the local strength analysis.