· Cybersecurity tool · Strength + breach exposure · 100% client-side
Cybersecurity password health checker
Two checks in one place. Strength is computed in your browser using a rule-based entropy approximation calibrated to NIST SP 800-63B Appendix A bands. Breach exposure is checked against Have I Been Pwned using the k-anonymity model: only the first 5 hex characters of the SHA-1 hash are sent to HIBP, never the password itself or the full hash.
Type a password to test
Strength is computed in your browser. The breach check sends only the first 5 characters of the SHA-1 hash to HIBP (k-anonymity model); the password itself never leaves your device.
What does the strength score actually measure?
The score approximates Shannon entropy of the password against a charset estimate (lowercase, uppercase, digits, symbols), then penalizes common patterns (sequences, repeats, dictionary words like "password" or "qwerty"). The bands map roughly to NIST SP 800-63B Appendix A guidance: under 30 bits of effective entropy is "very weak," 50-70 is "fair," 70+ is "good," 90+ is "strong." For audit-grade analysis, run the password through the full zxcvbn library or a corporate password manager's strength meter.
Why these two checks together
A password can be high-entropy and still be in attacker word lists if a user has reused it from a breached site. The strength bar tells you whether the password is hard to guess from scratch. The HIBP check tells you whether the password is already in a credential-stuffing corpus. Both can fail independently. Both should pass before you trust a password on any account that matters.
For organizational use, NIST SP 800-63B recommends checking new passwords against breach corpora at the point of registration. The Have I Been Pwned API is the most widely-adopted public source for this; many IDPs (Okta, Azure AD, Auth0) integrate it by default.
Assessments are for educational and career exploration purposes only. Results do not guarantee employment outcomes. The DecipherU Framework is designed for career guidance, not clinical or employment screening.
Sources
- NIST SP 800-63B Digital Identity Guidelines (Authentication) · 2017 + ongoing rev.
- Have I Been Pwned Pwned Passwords API · live
- Cloudflare HIBP k-anonymity post · 2018
- FIDO Alliance passkey specifications · 2024
Get cybersecurity career insights delivered weekly
Join cybersecurity professionals receiving weekly intelligence on threats, job market trends, salary data, and career growth strategies.
By subscribing you agree to our privacy policy. Unsubscribe anytime.