Type or paste a password to see how strong it is and whether it has appeared in a known data breach. The password never leaves your browser: the breach check sends only the first five characters of a one-way hash.
Strength is an estimate based on length, character variety and common patterns. Breach data comes from Have I Been Pwned’s Pwned Passwords service using k-anonymity, so the full password is never transmitted.
Type a password into the checker above and it does two separate things. The strength meter estimates how long it would survive an offline cracking attempt. The breach check asks Have I Been Pwned whether that exact password already appears in a known data leak — without ever sending the password itself.
How the breach check keeps your password private
The check uses a method called k-anonymity. Your browser hashes the password with SHA-1, sends only the first five characters of that hash, and receives back every leaked hash that starts with those five characters — usually several hundred. The comparison happens on your device. The service never learns which one you were asking about, and the password never leaves the page.
The database behind it holds credentials from more than a thousand breached sites and billions of exposed accounts, so a hit does not mean your account was broken into. It means that password has appeared in somebody’s leak, which is enough for it to be in the wordlists attackers try first.
What a hit actually means
| Result | What to do |
|---|---|
| Found thousands of times | Treat it as public. Change it everywhere you have used it, starting with email and banking. |
| Found a handful of times | Still change it. Even a few appearances put it in cracking dictionaries. |
| Not found, but the meter says weak | It is not leaked yet, but it is guessable. Replace it with something longer. |
| Not found and the meter says strong | Keep it, use it on one account only, and turn on two-factor authentication. |
How the strength meter works
The meter counts the character sets you used and the length to get a raw entropy figure, then subtracts for the patterns attackers try first: common words, keyboard runs like qwer and 1234, repeated characters, and years. That is why “Password2026!” scores badly despite having a capital, digits and a symbol — every one of those patterns is in the first few million guesses.
The crack-time estimate assumes an offline attack at 100 billion guesses a second, which is realistic for a well-funded attacker with modern GPUs working on a stolen password database. Online guessing against a live login is far slower, so the estimate is deliberately pessimistic.
Why offline attacks are the ones that matter
When a company is breached, attackers walk away with hashed passwords and crack them at their leisure. The 2022 LastPass breach is the standard example: encrypted vault backups were stolen, and weak master passwords were ground down offline for years afterwards, with United States investigators later linking large cryptocurrency thefts to those vaults. The lesson is not to avoid password managers — it is that the one password protecting everything else has to be long. Our LastPass breach analysis goes through what happened and what it changed.
What to do after a bad result
- Start with email. Whoever controls your inbox can reset every other account.
- Use a generated replacement. The generator on this page or in your password manager gives you something no wordlist contains.
- Do not reuse it. One password per account is the single habit that limits the damage of any future breach.
- Turn on two-factor authentication wherever it is offered, ideally with an authenticator app rather than text messages.
- Check the accounts, not just the password. Look for unfamiliar sign-ins, forwarding rules and recovery addresses you did not add.
If money has moved, contact your bank immediately. The Code of Banking Practice that took effect on 30 November 2025 commits New Zealand banks to 24/7 scam reporting and, where the bank has fallen short of its commitments, compensation of up to $500,000 for authorised scam payments. Report the incident to the NCSC as well, on 0800 114 115.
For the wider picture on what gets exposed in New Zealand breaches and what the law requires of the organisations involved, see our guides to privacy breaches and the Privacy Act 2020. To reduce how often you need this page at all, a manager is the answer — the password manager guide compares them for NZ users.
Disclaimer
General information only, not security or legal advice. Nothing typed into this page is stored or transmitted, apart from the five-character hash prefix described above.
Reference sources
Frequently asked questions
Is it safe to type my real password into this checker?
The password stays in your browser. Only the first five characters of its SHA-1 hash are sent, which match hundreds of unrelated passwords, so the service cannot tell which one you asked about. If you would still rather not, test a close variant of the same length and structure.
My password was found in a breach — has my account been hacked?
Not necessarily. It means the password appears in a leak somewhere, possibly from a different site or a different person who chose the same one. It is still unsafe to keep using, because attackers try leaked passwords against other services.
What is a good password strength score?
Aim for the meter to read strong or very strong, which is roughly 60 bits or more. Below 40 bits a determined attacker with a stolen database cracks it in minutes.
Does the checker store anything?
No. There is no account, no logging and no analytics on what you type. Closing the tab removes everything.
How often should I check my passwords?
Once, thoroughly, when you move into a password manager — most of them have a built-in health report that checks every saved login at once — and then whenever a service you use announces a breach.
What if the same password is on several of my accounts?
Change them all, starting with email, banking and anything holding payment details. Reused passwords are the reason a single breach spreads, and credential stuffing is one of the most commonly reported incident types in New Zealand.
