Password strength and breach check that runs entirely in your browser.
Live: https://yeeeeezus.github.io/pass-guard/
- Strength scoring with zxcvbn (Dropbox's realistic password strength estimator): score 0–4, guess counts, crack-time estimates, and specific feedback ("this is a top-10 common password", "add another word or two").
- Breach check against the Pwned Passwords corpus using the k-anonymity protocol: the password is hashed with SHA-1 locally, only the first 5 characters of the hash are sent, and the matching is done on your machine. The password itself never leaves the page — and cannot be reconstructed from what is sent.
Password reuse is the single most exploitable habit on the internet, and most "password checkers" are either joke meters or send the raw password to a server. This page is a plain static HTML file: no accounts, no logging, no backend, nothing to trust beyond two open data sources.
| component | provider | license/notes |
|---|---|---|
| strength engine | zxcvbn | Copyright Dropbox, loaded from CDN, executed locally |
| breach corpus | Pwned Passwords API by Troy Hunt | free, CORS-enabled, k-anonymity by design |
There is nothing to build — open index.html. Useful for a quick local server:
$ python3 -m http.server 8000