Pwned Passwords

About this tool

This tool uses hibp-js to check if a password exists in the Have I Been Pwned Password database. It contains +600M real-world passwords previously exposed in data breaches. This exposure makes them unsuitable for ongoing use as they're at a much greater risk of being used to take over other accounts.

This tool will first hash the password using SHA-1 and then send the first five characters to HIBP's server, which will return a list of hashes that starts with those characters. It then checks if the hash exists in the returned list and shows the result. In that process, no password will be stored or transmitted to HIBP. You can check their Privacy Policy.

How to improve your Passwords easily

With those 3 options, you can quickly improve your passwords by thinking in a passphrase.

1. Memorize a sentence and use only the 1st letter of each word (or only the second or last). Afterward, change possibly still certain letters into numbers or special characters.
2. Use a whole sentence as a password or string together different words connected by special characters.
3. Another option is randomly choosing 5-6 words from the dictionary and separating them with a space.

This results in a password that is easy to remember, easy to type, and difficult for attackers to crack.

Example of converting a weak password to a strong one

With these 7 steps, you can create a strong password:

1. Use, e.g., the phrase "Open sesame".
2. Rephrase it to "Oh dear sesame, please open up".
3. Transform the word "open" to "OPEN".
4. Change the uppercase letter "O" to "0" (zero).
5. Replace the whitespaces with hyphens (-) and underscores (_).
6. Switch the lowercase letter "l" in please with the number "1".
7. Add an exclamation mark at the end of the passphrase.

This results in the password: 0h-dear-sesame,_p1ease_0PEN_up!