01 / Password Audit

Password strength checker
See how secure your password is

Open and use it—no signup. After you type or paste, this tab runs a password strength check: it estimates entropy and crack time, then checks a public list of common leaked passwords that ships with the page. The password is not uploaded and is not written to analytics. This page can catch widely abused passwords. It cannot prove a string never appeared in any dump.

Browser-local Password not uploaded Public list check No account

Updates as you type · ~0.3 s

Masked by default. Not written to local storage, and not sent to the server.

Loading the weak-password list…

This result

Rating, entropy, and crack time appear as you type

Nothing to rate yet. After you type, you will see Weak / Medium / Strong / Very strong, and whether it hits the public leaked weak-password list.

[ 02 ] How to check

How to check password strength: paste the password, read the rating and crack time, and replace a weak one immediately.

Type or paste

01

Masked by default. Updates as you type; the rating appears in about 0.3 seconds. The password is not written to local storage and is not sent to the server.

Read the rating and crack time

02

The page shows Weak / Medium / Strong / Very strong, plus offline brute-force and online rate-limited time scales. A hit on the public weak-password list is forced to Weak.

Replace it if it is too weak

03

Create a new password locally in the password generator. Do not reuse the old one on important accounts. This page is not a full-web leak lookup.

[ 03 ] What it checks

How password strength is measured: first composition and brute-force cost, then this device’s leaked-password list. Both steps finish in this tab—they do not go through FastPwd’s servers.

Entropy and crack time

01

Bits are estimated from length and character classes, with offline brute-force and online rate-limited time scales. Shorter than 8 characters, too few classes, or keyboard sequences pull the rating down. Progress bar colors: Weak is red, Medium orange, Strong cyan, Very strong green.

On-device weak-password list

02

The list downloads with the page, then is searched in four steps: exact match, case fold, strip a trailing 0–999, and common Leet. A hit is marked Weak with a very high-risk warning. Strings longer than 128 characters get exact and case-fold matching only.

Not a full-web lookup

03

It can catch passwords that are already widely abused. It cannot prove a password never appeared in any breach. This page does not query Have I Been Pwned and does not send the password to an external API.

[ 04 ] Verifiable

What this password checker covers—and what it does not

The password strength checker only answers “does this string look strong right now.” Thresholds, list scope, and what it cannot do are written on this page.

Where it runs
This tab

Entropy, weak patterns, and the list check all run in the browser. The password does not enter an HTTP request and is not written to analytics. After you close the tab, this device does not keep that input.

Rating thresholds
80 / 60 / 40

Estimated entropy ≥ 80 bits is Very strong, ≥ 60 Strong, ≥ 40 Medium, otherwise Weak. Shorter than 8 characters, a common weak password, or a public-list hit is forced to Weak.

List scope
Public high-frequency

It checks a built-in public high-frequency leaked-password list, not a full-web dump set. Strings longer than 128 characters skip trailing-digit and Leet variants.

Status
Not stored

No signup. This site has no password vault and does not keep audit history. After you refresh, plaintext you did not save yourself does not appear on any remote system.

[ 05 ] FAQ

Common questions about the password strength checker

This page rates strength on this device. It is not a web-wide verdict. Entropy, weak-pattern checks, and the leaked-password list all run in this tab. The password is not sent as an HTTP request and is not written to analytics. After you close the page, that input is not left on FastPwd’s servers.
Not as a full-web breach lookup. This page checks a public list of common leaked passwords that ships with the page. A miss does not prove it never appeared in any dump. A hit means the string is too common and should be changed now. This page does not query Have I Been Pwned.
No. Offline brute force is estimated at about 10 billion guesses/sec; online rate-limited attacks at about 1000/sec. Real cost depends on the attacker’s hardware and the target site’s policy. The numbers compare relative strength; they are not a promise.
Use the password generator to create a new password on this device. Do not reuse the old one on important accounts. To send a new password to a colleague, use a Burn-Link; it burns after they open it once.
This page is a local password strength test: composition, entropy, and crack-time order of magnitude, then a public weak-password list shipped with the page. A leak lookup sends the password or a hash to an external API. FastPwd does neither, and it does not query Have I Been Pwned.
[ 06 ] Next
Check then →

If it is too weak, generate a new one. Create it, share it once, or back up a file—without leaving the browser. Passwords, keys, and files are not uploaded by default.

→ Open the password generator ↗ Burn-Link File Encryption Box