Password Checker
Analyzes your password's strength and, only on request, checks it against known leaks.
Everything on this page runs locally by default: the strength analysis (entropy, estimated crack time, weak patterns) is recalculated right here in your browser on every keystroke, with no network call at all. The only exception is the leak check, and it never fires on its own — only when you click "Check if this password has leaked". At that point, your browser computes the SHA-1 hash of your password and sends this server only the first 5 characters of that hash (never the password), which relays it to the Have I Been Pwned API and returns the matching suffixes for the final comparison, done right here in your browser. Full detail on the method (k-anonymity) is in "How the leak check works", below.
Typed here, it never leaves your browser — the analysis is always local.
How the strength analysis works
Strength is calculated by zxcvbn, the same model used by major tech companies to measure real-world passwords — very different from just counting length and character types. It tests the password against lists of passwords that have actually leaked, dictionary words (in Portuguese and English), proper names, dates, keyboard sequences and repetitions, and estimates how many guesses an attacker would need. That's why "P@ssw0rd1" can score low even though it looks "complex" at first glance — it's an obvious variation of a word plus an extremely common substitution pattern (l33t speak), exactly the kind of thing an attack dictionary tries first.
What the 4 crack scenarios mean
Crack time depends entirely on HOW someone tries to guess the password, not just on the password itself — that's why the tool shows 4 scenarios, from slowest to fastest for the attacker. "Online, throttled" is a site that blocks IPs after a few wrong attempts. "Online, unthrottled" is a site without that protection. "Offline, slow hash" is the scenario after a breach of a well-protected database (bcrypt, Argon2, scrypt), where every attempt is deliberately expensive. "Offline, fast hash" is the worst case: a breach with weak (or no) hashing tested on dedicated hardware (GPUs, FPGAs) — the same password that would take centuries in the first scenario can fall in seconds in this last one.
How the leak check works (k-anonymity)
The check uses Have I Been Pwned's Pwned Passwords API with a method called k-anonymity, designed specifically to never reveal the real password to anyone. Your browser computes the SHA-1 hash of the password and sends only the first 5 characters of that hash to this server — never the password, never the full hash. The server relays that prefix to the HIBP API, which responds with the list of ALL known hash suffixes that start with that same prefix (typically hundreds), each with its breach occurrence count. Your browser then looks for YOUR password's suffix in that list — the final comparison, the only one that actually matters, happens right there, locally. No one along the way (neither HIBP nor Nexinon) can tell which exact password you're checking, only that someone queried that prefix among thousands of possible passwords.
Limitations
A high score here doesn't mean the password will never leak in the future, nor that it's safe in every context — a site with a weak password policy, or a breach caused by something else entirely (phishing, malware), doesn't depend on the password's own strength. The leak check also doesn't warn you if the SAME password is reused across several of your accounts — each check is about the typed text, not about where it's used. Finally, "not leaked" is never a security guarantee: it only means that exact password hasn't shown up in the breaches Have I Been Pwned has indexed so far.
Frequently asked questions
Only if you click "Check if this password has leaked" — and even then, only the first 5 characters of its SHA-1 hash, never the password itself. The strength analysis runs entirely in your browser, with no network call at all.
It's the method the leak check uses to never reveal your password to anyone — not to Nexinon, not to Have I Been Pwned. See "How the leak check works", above, for the full mechanics.
They're two different questions: strength measures how easy the password is to GUESS (by dictionary, pattern, brute force); leak status measures whether it has already shown up in a stolen database. A password nobody has ever used before might never have leaked and still be predictable enough for a dictionary attack — the two metrics answer different questions.
Because a leak has nothing to do with how good the password was at the moment it was stolen — breaches happen from a service's own failure (a hacked database), phishing, or malware on your device, not because the password was "weak". A random 20-character password can leak just as easily as an obvious one.
zxcvbn (the actively maintained zxcvbn-ts fork), the same open-source model popularized by Dropbox and used by many services today — it runs 100% in your browser and never sends the password anywhere.
The analysis library ships with real frequency lists of leaked passwords (in English and Portuguese) — if your password (or an obvious variation of it, with capitalization or l33t speak) is among the most used in the world, the "Very common password" badge shows up.
Because crack time isn't a fixed property of the password — it depends on how many guesses per second the attacker can make. A site that blocks IPs after a few wrong attempts is a completely different scenario from a leaked database being attacked with dedicated hardware. See "What the 4 crack scenarios mean", above.
Nexinon Principles
Hybrid
Hybrid execution — part in your browser, part on the server; the page details what each side seesNo account needed
Use it now, no account or password.Free
No usage limits, no paid plan.Trustworthy content
Full explanation behind every tool, not just the result.