This password strength checker estimates how hard a password might be to guess, and it can optionally check whether that password has appeared in a known data breach. Both steps are designed so that Impulsblog never receives the password. The strength score is calculated entirely in your browser. The optional breach check uses Have I Been Pwned’s k-anonymity range API: your browser hashes the password with SHA-1, then sends only the first five hexadecimal characters of that hash to https://api.pwnedpasswords.com/range/. The full password and the rest of the hash stay on your device. Have I Been Pwned returns a list of hash suffixes that share the same five-character prefix, and your browser looks for a match locally.
This page contains no affiliate links. See our affiliate disclosure and how we review. By Impulsblog Editorial. Updated: November 2026
Bottom line: the password stays on your device
- Strength is an in-browser estimate (length, character mix, and some common weak patterns).
- The optional breach check sends only a five-character SHA-1 hash prefix to Have I Been Pwned, never the password.
- A match means you should stop using that password. No match is not a green light to reuse it.
- Generate a new unique secret with the password generator and store it in a manager.
Check a password locally
The optional breach check hashes the password in your browser with SHA-1, then sends only the first five hexadecimal characters of that hash to Have I Been Pwned’s range API (api.pwnedpasswords.com/range/). The password itself and the rest of the hash never leave this device. Impulsblog does not receive either one.
How the strength estimate works
The local estimate looks at length, the mix of lower case, upper case, digits and symbols, and some common weak patterns such as repeated characters or simple sequences. It then reports an approximate entropy in bits and a label from very weak to very strong. Treat this as a guide. A password can look “strong” because it is long and mixed, and still be a bad choice if you have used it on another site. A short phrase of common words can also be weaker than the label if someone is guessing from a word list. This tool does not replace a password manager or two-factor authentication.
How the breach check keeps the password local
Have I Been Pwned maintains a large list of passwords that have appeared in public breach data, stored as SHA-1 hashes. The range API is built so that a client can ask whether any hashes sit in a five-character prefix bucket, without handing over the password or the full hash. We also send the Add-Padding request header, which is Have I Been Pwned’s recommended way to make the size of the response less revealing. Impulsblog does not log the prefix, does not see the password, and does not run this check unless you click the button.
A match means this password has appeared in a known breach at least once and should not be used. No match means it was not in that dataset — not that it is unique or safe to reuse. SHA-1 is used here only because that is the format the range API provides; the password itself is not stored. If you need a new secret, use the password generator, then save it in a manager. Our password manager guide covers what to look for before you pick one.
FAQ
Does my password leave the browser?
The strength estimate never leaves your browser. If you click the breach-check button, only the first five characters of a SHA-1 hash are sent to api.pwnedpasswords.com. The password and the remaining hash characters stay on your device.
What does k-anonymity mean here?
K-anonymity means the server sees only a hash prefix that many other passwords also share, not a unique identifier for your password. Have I Been Pwned returns every hash suffix in that prefix bucket; your browser then looks for a local match.
If there is no match, is the password safe?
No match means it was not in that breach dataset. It does not mean the password is unique, strong, or safe to reuse. A new, random password stored in a manager is still the better habit.
Why does the check use SHA-1?
Have I Been Pwned’s public range API indexes passwords as SHA-1 hashes, so the client must use the same function to look up a prefix. The password is not stored, and SHA-1 is used only for this lookup format.
Should I type my master password into this page?
The page does not store what you type, but you should only do this on a device and browser you trust. On a shared or untrusted computer, do not enter any password you care about.
Related guides: Strong password generator · Best password managers (2026) · Bitwarden vs 1Password · Bitwarden vs Proton Pass