100% Private • Nothing Stored • Breach Detection • Free Password Generator
Yes, 100%. Your password never leaves your browser. It's not stored, logged, or sent to any server. We have no way to see it.
It uses k-anonymity with the Have I Been Pwned API. Your password is hashed with SHA-1, and only the first 5 characters of the hash are sent. The server returns a list of matching hashes — your actual password is never transmitted.
60+ bits is good, 80+ bits is strong, 100+ bits is very strong. Aim for 12+ characters with mixed case, numbers, and symbols.
It estimates how long a modern GPU-based attack would take to brute-force your password. Based on 100 billion guesses per second.
Yes, immediately. If your password appears in a breach, change it on all sites where you use it and enable 2FA.
Yes. They're generated using your browser's cryptographically secure random number generator (crypto.getRandomValues). Nothing is sent to any server.
A passphrase is a series of random words (like "correct-horse-battery-staple"). They're easier to remember and very secure.
No. Everything runs in your browser. Even our breach check uses k-anonymity so your password stays private.