Credential Security
Has your password already been leaked?
A password can look strong and still be worthless. If it has appeared in a breach, it is already sitting in the wordlists attackers try first — complexity will not save it. This checks both: how it holds up to cracking, and whether it is already out there.
- The breach lookup uses k-anonymity: your password is hashed, and only the first five characters of that hash are sent upstream. Have I Been Pwned never receives your password or a full hash, and we match the rest locally.
- Nothing is stored, logged, or written to a database at any point.
- Strength scoring runs entirely in your browser and estimates offline cracking at 100 billion guesses per second — roughly a modern GPU rig, not a phone.
- A clean result means the password is not in the public breach corpus. It does not mean nobody knows it.
Worried about credentials across your organisation?
We audit credential hygiene, password policy and exposed logins at scale — not one password at a time.