Type or paste a password to see how strong it is and whether it has appeared in a known data breach. The password never leaves your browser: the breach check sends only the first five characters of a one-way hash.
Strength is an estimate based on length, character variety and common patterns. Breach data comes from Have I Been Pwned’s Pwned Passwords service using k-anonymity, so the full password is never transmitted.
The password checker at the top of this page does two independent jobs. The strength meter estimates how long your password would survive an attacker trying to crack it, based on its length, the mix of characters and the predictable patterns it contains. The breach check asks the Have I Been Pwned database whether that exact password already appears in a known data leak — and it does this without ever sending the password itself off your device. This guide explains what each result means, what to do about a bad one, and how to choose a password that holds up.
Key points
- The strength meter estimates how long your password would resist cracking; the breach check asks whether it has already leaked.
- Your password never leaves your device — only the first five characters of its SHA-1 hash are sent, using k-anonymity.
- A breach hit means the password is in attackers’ wordlists, not that your account was necessarily broken into. Change it anyway.
- Length beats complexity: a long passphrase or 16+ random characters outperforms a short password full of symbols.
- Use a unique password per account, turn on two-factor authentication, and let a password manager handle the rest.
How the breach check keeps your password private
The breach check uses a technique called k-anonymity, which lets you ask “has this password leaked?” without revealing the password. Your browser first turns the password into a SHA-1 hash — a fixed-length string of letters and numbers that cannot be reversed back into the original text. It then sends only the first five characters of that hash to the service and receives back every leaked hash that begins with those five characters, usually several hundred of them. The final comparison happens on your device. Because hundreds of unrelated passwords share the same five-character prefix, the service never learns which one you were asking about, and the password never leaves the page.
The database behind the check holds hundreds of millions of unique passwords pulled from thousands of breached websites and billions of exposed accounts. A match therefore does not mean your account was broken into. It means that exact password has turned up in somebody’s leak somewhere — which is enough for it to sit in the wordlists that attackers try first. Our guide to Have I Been Pwned explains how the wider service checks email addresses as well as passwords.
Quick facts
| Sent from your device | Only the first 5 characters of the password’s SHA-1 hash |
|---|---|
| Stored or logged | Nothing — no account, no analytics on what you type |
| Where the checks run | Strength scoring and the final breach match happen in your browser |
| Breach data source | Have I Been Pwned “Pwned Passwords” range search |
| Offline crack benchmark | ~10 billion guesses per second (stolen database) |
| Online guessing benchmark | ~100 guesses per second (live login) |
What a hit actually means
The number beside a breach result matters. A password that appears tens of thousands of times is effectively public; one that appears a handful of times is still unsafe. Use the table below to decide how urgently to act.
| Result | What it means | What to do |
|---|---|---|
| Found thousands of times | Treat it as public knowledge | Change it everywhere you have used it, starting with email and banking. |
| Found a handful of times | Already in cracking dictionaries | Still change it — even a few appearances put it on attackers’ lists. |
| Not found, but the meter says weak | Not leaked yet, but guessable | Replace it with something longer before it ends up in a leak. |
| Not found and the meter says strong | A good password | Keep it, use it on one account only, and turn on two-factor authentication. |
How the strength meter works
The meter counts the character sets you have used — lower case, upper case, digits and symbols — together with the length, to work out a raw entropy figure. Entropy is simply a measure of unpredictability, expressed in bits: each extra bit doubles the number of guesses an attacker needs. It then subtracts bits for the patterns that attackers try before anything else: dictionary words, keyboard runs like qwerty or 1234, repeated characters, and years such as 2026.
This is why a password like “Password2026!” scores poorly despite having a capital letter, digits and a symbol. Every one of those elements is predictable, so the whole string falls within the first few million guesses. Length beats complexity: a long string of ordinary words is far harder to crack than a short one peppered with substitutions. A random four- or five-word passphrase, or 16 or more random characters, comfortably clears the level the meter calls strong. The tool at the top of this page will not create one for you, but the section below explains two easy ways to build a password this strong.
Why the crack-time estimates look the way they do
The tool shows two very different numbers. The offline estimate assumes an attacker has stolen a database of hashed passwords and is grinding through guesses on their own hardware at about 10 billion attempts a second — realistic for modern graphics cards working on a leaked file with no one to stop them. The online estimate assumes an attacker is typing guesses into a live login form at roughly 100 attempts a second, which is all most services allow before they lock the account or add delays.
That gap of a hundred million times is the whole point. A password that would take days to guess against a live login might fall in seconds once its hash is stolen. Because you rarely know in advance which sites will be breached, the offline figure is the one worth trusting, and the meter is deliberately built around the pessimistic case.
Why offline attacks are the ones that matter
When a company is breached, attackers walk away with hashed passwords and crack them at their leisure — there is no lockout, no rate limit and no one watching. The 2022 LastPass breach is the textbook example: encrypted vault backups were stolen, and vaults protected by weak master passwords were ground down offline in the months and years afterwards. United States investigators later linked a string of large cryptocurrency thefts to those stolen vaults. The lesson is not to avoid password managers — they remain the best tool for the job — but that the single password protecting everything else has to be long and unique. Our LastPass breach analysis walks through what happened and what it changed.
How to build a password that passes
You do not need to memorise a string of random symbols to score well. The two approaches below both produce passwords the meter rates strongly, and both are easier to live with than the “capital, number and special character” advice that produced a generation of guessable passwords.
- A random passphrase. Four or five unrelated words chosen at random — for example otter-ladder-quartz-mango — are long enough to be strong yet possible to remember. The words must be random, not a phrase from a song or a saying, because attackers feed known quotes and lyrics into their guessing lists.
- A random string. Sixteen or more characters drawn at random from a full keyboard produce very high entropy in a small space. You will not remember these, which is exactly why they belong in a password manager rather than in your head.
Whichever you choose, the rules are the same: make it unique to one account, never base it on your name, birthday, pet or team, and do not simply add a number to an old password you already use. If you want the tool to do the work, generate one with our password generator and paste it straight into the account you are securing.
Where passkeys fit in
A growing number of services now offer passkeys, which replace the password with a cryptographic key stored on your device or in your password manager and unlocked with your fingerprint, face or PIN. Because there is no shared secret to type, guess or leak, a passkey cannot appear in a breach database at all and there is nothing for this checker to test. Passkeys will not cover every login yet, so strong, unique passwords still matter — but where a service offers a passkey, taking it up removes one more password from the pile you have to protect.
What to do after a bad result
If the checker finds your password in a breach, or the meter rates it weak, work through these steps in order. The goal is to contain the damage quickly and stop one exposed password from unlocking the rest of your life.
- Start with email. Whoever controls your inbox can trigger a password reset on almost every other account, so fix that one first.
- Use a generated replacement. A password from a generator or your password manager is something no wordlist contains, unlike anything you would invent by hand.
- Never reuse it. One password per account is the single habit that limits the blast radius of any future breach.
- Turn on two-factor authentication wherever it is offered, ideally with an authenticator app or a passkey rather than text messages, which can be intercepted.
- Check the account, not just the password. Look for sign-ins you do not recognise, mail-forwarding rules you did not set, and recovery phone numbers or addresses that are not yours.
If a reused password has spread across several logins, change them all — starting with email, banking and anything holding payment details. Reused passwords are the reason a single breach cascades: attackers take a leaked email-and-password pair and try it automatically across hundreds of other services, a tactic called credential stuffing that is among the most commonly reported incident types in New Zealand.
If money has moved
Contact your bank immediately — speed matters far more than tidiness. New Zealand’s Code of Banking Practice, updated on 30 November 2025, commits banks to a set of anti-scam protections including 24/7 reporting channels, Confirmation of Payee name-checking and warnings on high-risk payments. Where a bank falls short of those commitments, an eligible customer can be reimbursed for all or part of an authorised scam payment, up to a maximum of $500,000. Report the incident to the National Cyber Security Centre as well, on 0800 114 115, which is now the single line for cyber incidents after CERT NZ merged into the NCSC.
For the bigger picture on what gets exposed in New Zealand and what the law requires of the organisations that hold your data, see our guides to data breaches in New Zealand and the Privacy Act 2020. To stop needing this page in the first place, a manager is the answer: our password manager guide compares the main options for New Zealand users and explains how the built-in health reports check every saved login at once.
Disclaimer: General information only, not security, financial or legal advice. Nothing you type into the checker is stored or sent from your device, apart from the five-character hash prefix described above. Report the figures and steps here as a starting point, and follow your bank’s and the NCSC’s current guidance for your own situation.
Reference sources
Frequently asked questions
Is it safe to type my real password into this checker?
Yes. The password stays in your browser, and only the first five characters of its SHA-1 hash are ever sent. Those five characters match hundreds of unrelated passwords, so the service cannot tell which one you asked about. If you would still rather not, test a password of the same length and structure that you have changed slightly.
My password was found in a breach — has my account been hacked?
Not necessarily. It means that password appears in a leak somewhere, possibly from a different site or even a different person who happened to choose the same one. It is still unsafe to keep using, because attackers routinely try leaked passwords against other services in the hope that they have been reused.
What counts as a good password strength score?
Aim for the meter to read strong or very strong, which is roughly 60 bits of entropy or more; 70 bits and above is comfortably future-proof. Below about 40 bits, an attacker with a stolen database can crack the password in minutes, so treat anything the meter flags as weak as a password to replace.
Does the checker store or log anything?
No. There is no account, no logging and no analytics on what you type. The strength calculation and the final breach comparison both run on your device, and closing the tab clears everything.
What is the difference between the offline and online crack times?
The online figure assumes an attacker is guessing against a live login, which most sites slow to about 100 attempts a second. The offline figure assumes your password’s hash has been stolen and is being attacked on the attacker’s own hardware at around 10 billion attempts a second. The offline number is far lower and is the one worth planning around, because you cannot control which sites get breached.
