Check password strength and breach exposure
Review common password weaknesses, see an illustrative offline-guessing estimate, and check for known breach exposure without sending your raw password to OHC.
Enter a password to check
For privacy, use a password you are willing to assess. This check is advisory and does not prove that a password is safe.
The raw password is analyzed in your browser. For the breach check, only the first five characters of its SHA-1 hash are sent to Have I Been Pwned; the password itself is not sent.
Estimated time for offline guesses
Illustrative estimate for a fast MD5 hash at 200 billion guesses per second: 0 seconds.
This is not a prediction for every system. Slow password-hashing algorithms, salts, hardware and search strategy can change the time substantially.
Known breach exposure
Enter a password to check whether its hash appears in known breach data.
Password analysis
- Enter a password to see strength guidance.
How to improve password security
- Use a long, unique password for every account.
- Avoid names, dates, common phrases and predictable substitutions.
- Use a password manager and enable multi-factor authentication where available.
- Change a password if the breach check reports that it has appeared in known data.
A password not found in breach data may still be weak or reused. A breach match is a reason to change it, not a measure of how an account was accessed.
Frequently asked questions
How does the password strength checker work?
It analyzes the password in your browser with the open-source HSIMP library and estimates the time an offline attack would need at a stated guess rate: 200 billion guesses per second, a fast-hash GPU scenario.
Is my password sent to OnlineHashCrack or to Have I Been Pwned?
The raw password never leaves your browser. For the breach check, a SHA-1 hash is computed locally and only its first five characters are sent to the Have I Been Pwned range API.
What does a breach match mean?
The password appears in a known breach dataset, so attackers can try it directly. Change it everywhere you use it and choose a unique replacement.
Why is the time estimate only illustrative?
Real attack speed depends on the hash algorithm, salts, hardware and search strategy. Slow password hashes such as bcrypt reduce guess rates by orders of magnitude compared with MD5.
Test how authorized password hashes hold up against GPU-accelerated cracking with OHC.
Review an authorized password audit