Password leak & strength checker
Test any password against hundreds of millions of leaked credentials and get an instant strength score. Everything runs in your browser — only the first 5 characters of your password’s SHA-1 hash are ever sent.
Generate a strong password
Enter values to see results
- At least 12 characters
- Lower- and uppercase letters
- A digit
- A symbol
- No obvious patterns or repeats
Private by design: your password never leaves your browser. It is hashed locally with SHA-1 and only the first 5 characters of that hash are sent to the breach database (k-anonymity). Nothing is stored or logged. Data source: Have I Been Pwned — Pwned Passwords
Why check a password?
Attackers don’t guess passwords one by one — they replay lists of billions of real passwords leaked from past breaches (“credential stuffing”). If your password appears in any of those lists, it is effectively public, no matter how complex it looks. This tool tells you two things at once: has this exact password already leaked, and how hard is it to guess.
How the leak check stays private
Your password is hashed with SHA-1 inside your browser. Only the first five characters of the hash are sent to the Pwned Passwords range API, which returns every leaked hash sharing that prefix (hundreds of them). Your browser finds the match locally. The service never sees your password or its full hash — this is the industry-standard k-anonymity model.
What makes a strong password
- Length beats complexity. A 4-word passphrase like
coral-donkey-atlas-verbis stronger and easier to remember thanP@ssw0rd!. - Unique per site. Reuse is what makes one breach cascade into many. Use a password manager.
- Never a known-leaked password — even a long one is worthless once it’s on a list.
- Add a second factor wherever possible; Adgora accounts support TOTP two-factor authentication.
Questions about this tool
Is it safe to type my real password here?
Yes. The password is processed entirely in your browser; only a 5-character hash prefix is ever transmitted, which cannot be reversed to your password. That said, best practice is to check passwords you are considering, then store them in a password manager.
What does the breach count mean?
It’s the number of times that exact password has been seen across known data breaches. Any number above zero means the password is compromised and should never be used.
Does a “not found” result mean my password is safe?
It means the password hasn’t appeared in the breach corpus yet. Combine that with a strong length and a second factor for real safety.
Is the generated password sent anywhere?
No. It is made by your browser’s cryptographic random generator and checked the same private way — only the 5-character hash prefix leaves the page.
Related tools
UTM link builder
Build clean, trackable campaign URLs with UTM parameters (source, medium, campaign, term, content). Free, instant, in-browser.
Open toolAd creative checker
Check a banner before you upload it: file type, weight, pixel size and which standard ad sizes it fits. Runs in your browser — the image is never uploaded.
Open toolCPM / CPC / eCPM calculator
Free CPM, CPC, CPA and eCPM calculator. Convert impressions, clicks and spend into revenue, CTR and effective CPM.
Open toolReady to turn traffic into crypto?
Run CPC/CPM/CPA campaigns or monetize your site with a single tag. Top-ups through Payora with 24 cryptocurrencies and 50 currency/network payment methods.
