Password Strength & Breach Checker
Analyse password length and predictable patterns locally, then optionally check known breach exposure with the privacy-preserving HIBP Pwned Passwords range API.
Three simple steps
A current version of Chrome, Brave, Edge, Firefox or Safari is recommended.
Enter the password
Your password stays in the current browser tab. Local checks update as you type.
Review local analysis
Check length, character diversity and predictable patterns before any external request is made.
Check breach exposure
Only if you choose, the browser hashes the completed password and sends the first five SHA-1 characters to HIBP with response padding enabled.
What password strength & breach checker does
Local strength analysis is intentionally conservative and looks for length, repetition, sequences and common patterns. The HIBP result is a separate compromised-password lookup, not a guarantee that an unlisted password is safe.
Why local secret generation matters
Passwords are exceptionally sensitive data. When a browser can generate or analyse them safely, sending the complete value to a remote service creates risk without adding value. Ryo Tools keeps that work local whenever possible.
Password Strength & Breach Checker FAQ
Common questions about privacy, security and browser support.
Is strength & breach checker free?
Yes. This Password Toolkit operation is free and does not require a Ryo payment or an account.
Is the secret sent to Ryo Tools?
No. The generator and local analysis code runs in your browser. The plugin does not intentionally upload the generated or entered secret to WordPress.
Which browsers are recommended?
Use a current version of Chrome, Brave, Edge, Firefox or Safari so the required browser cryptography and clipboard features are available.
How does the HIBP breach check protect the password?
The browser computes the SHA-1 hash locally and sends only its first five characters. HIBP returns possible suffix matches, padded to reduce information leakage, and the exact comparison happens in your browser.
Why is SHA-1 used here?
SHA-1 is used only because the HIBP range service indexes compromised-password hashes that way. Ryo Tools is not recommending SHA-1 for password storage or new cryptographic designs.
