01 / Password Audit

Password strength checker
Test locally whether it is safe enough

Open and use it—no signup. After you type or paste, this tab runs a password strength test: it estimates entropy and crack time, then checks a public leaked weak-password list shipped with the page. The password is not uploaded and is not written to analytics. This page can catch common weak passwords, but it cannot prove a string never appeared in any dump.

Browser-local Password not uploaded Public list check No account

Updates as you type · ~0.3 s

Masked by default. Not written to local storage, and not sent to the server.

Loading the weak-password list…

This result

Rating, entropy, and crack time appear as you type

Nothing to rate yet. After you type, you will see Weak / Medium / Strong / Very strong, and whether it hits the public leaked weak-password list.

[ 02 ] How to check

How to run a password strength check: paste the password, read the rating and crack time, and replace a weak one immediately.

Type or paste

01

Masked by default. Updates as you type; the rating appears in about 0.3 seconds. The password is not written to local storage and is not sent to the server.

Read the rating and crack time

02

The page shows Weak / Medium / Strong / Very strong, plus offline brute-force and online rate-limited time scales. A hit on the public weak-password list is forced to Weak.

Replace it if it is too weak

03

Draw a new password locally in the online password generator. Do not reuse the old one on important accounts. This page is not a full-web leak lookup.

[ 03 ] What it checks

How password strength is measured: first composition and brute-force cost, then this device’s weak-password list. Both steps finish in the current tab—they do not go through FastPwd’s servers.

Entropy and crack time

01

Bits are estimated from length and character classes, with offline brute-force and online rate-limited time scales. Shorter than 8 characters, too few classes, or keyboard sequences pull the rating down. Progress bar colors: Weak is red, Medium orange, Strong cyan, Very strong green.

On-device weak-password list

02

The list downloads with the page, then is searched in four steps: exact match, case fold, strip a trailing 0–999, and common Leet. A hit is marked Weak with a very high-risk warning. Strings longer than 128 characters get exact and case-fold matching only.

Not a full-web lookup

03

It can catch passwords that are already widely abused. It cannot prove a password never appeared in any breach. This page does not query Have I Been Pwned and does not send the password to an external API.

[ 04 ] Verifiable

What Password Audit covers—and what it does not

The password strength checker only answers “does this string look strong right now.” Thresholds, list scope, and what it cannot do are written on this page.

Where it runs
This tab

Entropy, weak patterns, and the list check all run in the browser. The password does not enter an HTTP request and is not written to analytics. After you close the tab, this device does not keep that input.

Rating thresholds
80 / 60 / 40

Estimated entropy ≥ 80 bits is Very strong, ≥ 60 Strong, ≥ 40 Medium, otherwise Weak. Shorter than 8 characters, a common weak password, or a public-list hit is forced to Weak.

List scope
Public high-frequency

It checks a built-in public high-frequency leaked-password list, not a full-web dump set. Strings longer than 128 characters skip trailing-digit and Leet variants.

Status
Not stored

No signup. This site has no password vault and does not keep audit history. After you refresh, plaintext you did not save yourself does not appear on any remote system.

[ 05 ] FAQ

Common questions about the password strength checker

This page gives a local strength assessment, not a web-wide verdict. Entropy, weak-pattern checks, and the weak-password list all run in the current tab. The password is not sent as an HTTP request and is not written to analytics. After you close the page, that input is not left on FastPwd’s servers.
Not as a full-web breach lookup. This page checks a public high-frequency leaked-password list shipped with the page, to catch passwords that are already widely abused. A miss does not prove it never appeared in any dump; a hit only means the string is too common and should be changed now. This page does not query Have I Been Pwned.
No. Offline brute force is estimated at about 10 billion guesses/sec; online rate-limited attacks at about 1000/sec. Real cost depends on the attacker’s hardware and the target site’s policy. The numbers compare relative strength; they are not a promise.
Use the password generator to draw a new password on this device. Do not reuse the old one on important accounts. To hand a new password to a colleague, use a Burn-Link; it burns after they open it once.
This page is a local password strength test: composition, entropy, and crack-time order of magnitude, then a public weak-password list shipped with the page. A leak lookup sends the password or a hash to an external API. FastPwd does neither, and it does not query Have I Been Pwned.
[ 06 ] Next
Check then →

If it is too weak, draw a new one. Generate, share once, and back up a file without leaving the browser. Plaintext, keys, and files are not uploaded by default.

→ Open the password generator ↗ Burn-Link File Encryption Box