Password Shield
Assess password strength, generate passwords and optionally check for breaches.
A little thought. A stronger password.
What makes it
easy to guess?
Check a pattern locally. The score is a guide, not a guarantee.
Up to 128 characters. Analysis stays local unless you explicitly request the online check below.- Length
- 0 characters
- Character types
- None
- Patterns reported
- None
- Character-space model
- 0 bits
Explore illustrative guessing scenarios
These assume fixed rates. They are not predictions of a specific attacker or account’s protection.
Has it appeared in a breach?
Optional: sends a five-character SHA-1 hash prefix to Pwned Passwords. Your full password is not sent; the service still sees the network request.
Online breach lookup is off
Local analysis stays in this browser.
Something new.
Something yours.
Choose a form, then generate a fresh random value.
Word list: EFF / Joseph Bonneau (CC BY 4.0). Generate locally, then store the value somewhere trusted. Copying puts it on your system clipboard.
Less predictable.
More considered.
Look beyond a mixture of symbols. Explore familiar patterns, create a random alternative, and use the optional breach check with a clear understanding of what it sends.
How to use Password Shield
- Look at the pattern.Enter a password for local feedback. Scores are estimates.
- Read the context.Review patterns, suggestions and any illustrative guessing scenarios.
- Choose a fresh start.Generate a passphrase, password or numeric PIN with the settings you need.
- Keep control.Copy and store your new value. Request an online breach lookup only if you choose to.
Does checking strength send my password anywhere?
Pattern analysis uses a local copy of zxcvbn and runs in your browser. The optional Pwned Passwords lookup is off by default and requires a separate Check action. This tool does not save your entered or generated password. Clearing the field is not a secure wipe of browser memory or your clipboard.
What does the online breach check send?
After you enable it and click Check, the browser hashes your password locally with SHA-1 and sends only the first five hexadecimal characters to Pwned Passwords. Returned hash suffixes are matched locally. The service still sees the request and network information such as your IP address; this is not complete anonymity. A missing match is not proof of safety.
How reliable are the strength and time estimates?
The score uses known patterns and dictionaries. Time scenarios assume specific guessing rates; they are illustrative, not predictions for a particular account or attacker. Character-space figures are a simplified ASCII model, not measured password entropy. Non-ASCII text is not assigned that figure. Input analysis is limited to 128 characters.
How are new passwords generated?
Generation uses crypto.getRandomValues with rejection sampling. Passphrases use the locally bundled 7,776-word EFF Long Wordlist and default to six words (about 77.5 random-choice bits). The displayed calculation uses the actual word count or allowed character pool, not a cracking-time guarantee. Password sets define allowed characters, not required characters; you can exclude l, 1, I, O and 0. Numeric PINs have limited strength. Save generated values in a trusted place.
What should I do with the result?
Use unique passwords or randomly generated passphrases and review the local feedback. No score certifies a password as safe. If a password appears in the breach dataset, replace it wherever you use it. Copying places the value on your system clipboard; this tool does not manage or erase that clipboard.