devvkit / dev

Password Strength Checker

Score passwords with zxcvbn and check for known breaches via HIBP.

Have I Been Pwnedtype 8+ characters to check

Uses k-anonymity: only the first 5 characters of the SHA-1 hash are sent to the HIBP API; the full hash and password never leave your browser.

share this tool

related tools

Password Generator

Generate strong, secure passwords with customizable character sets and entropy.

.env File Validator

Lint .env files: syntax, duplicates, secrets, and clean exports.

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 hashes for text and files.

Score passwords with zxcvbn, the entropy-based strength estimator used by Dropbox and GitHub. Check against the Have I Been Pwned breach corpus with k-anonymity: the full password never leaves your browser.

>[x]Features

-zxcvbn entropy scoring with crack-time estimates
-Live score meter and actionable suggestions
-Breach check via HIBP k-anonymity (SHA-1 prefix only)
-Minimum length enforcement (8+ characters)
-Graceful offline handling when the API is unreachable
-Sample passphrase for instant demo

>>Use Cases

>Evaluating passwords before committing to them
>Auditing password policies for your team
>Deciding whether a reused password is safe
>Teaching what makes a password strong

Frequently Asked Questions

>Is my password sent to a server??

For strength scoring, no: zxcvbn runs locally. For the breach check, only the first 5 characters of the SHA-1 hash are sent to the HIBP API (k-anonymity), never the password itself.

>What is zxcvbn??

A password strength estimator that models how attackers actually guess passwords: dictionary words, common patterns, sequences, and keyboard walks. It also provides suggestions to improve your password.

>What does "pwned" mean??

The password appears in the Have I Been Pwned breach corpus: it has been exposed in a known data breach and should not be reused, even if it scores strongly.