Free Password Health Check
Find out how strong a password is and if it has leaked in a data breach. Free, no sign-up, and your password never leaves your browser.
- Strength and what to fix
- Breach check against billions of leaked passwords
- Nothing sent, nothing saved
How the breach check works without seeing your password
Hashed in your browser
Your password is turned into a SHA-1 fingerprint on your device. The password itself is never sent.
Only 5 characters leave
The first 5 characters of the fingerprint go to the Have I Been Pwned range API. Hundreds of passwords share them.
Matched on your device
The list that comes back is compared here, in your browser. Nobody, including us, learns your password.
What makes a password weak
It is common
Passwords like 123456, qwerty or P@ssw0rd are tried first, whatever their disguise.
It follows a pattern
Runs like abcd or 1234, keyboard rows, repeated characters and years are easy to guess.
It has leaked
A password found in a data breach is in attackers' lists, even if it looks strong.
Questions
Is it safe to type my password into a password checker?
On this page, yes. Strength is checked in your browser, and only the first 5 characters of the password's SHA-1 fingerprint are sent to the Have I Been Pwned range API. SyFly never receives anything.
How do I know if my password has been leaked?
Type it above and press Check password. If it appears in a known data breach you will see how many times it was found.
My password was found in a breach. What now?
Change it everywhere you used it, starting with email and banking, and use a different random password for each site.
It says strong but it was found in breaches. Which is right?
Both. It is hard to guess, but attackers already have it in their lists, so it must be changed.
Where does the breach data come from?
From Have I Been Pwned, a free service that collects passwords exposed in public data breaches.
Is it really free?
Yes, with no account and no limit.