Free tool · by AlphaIT
Password Leak Checker and Strong Password Generator
Find out whether a password has appeared in a known data breach, without sending the password anywhere. Then make a strong, memorable replacement.
Make a strong password
Generated in your browser with a secure random source. Passphrase words come from the EFF short word list (CC BY 3.0).
What actually keeps accounts safe
Four Habits That Matter More Than Symbols
Most accounts aren’t broken into by guessing. They’re opened with passwords leaked from another site, or stolen by a fake sign-in page.
One password per account
When one site is breached, attackers try the same email and password everywhere. A unique password stops that chain.
Length over complexity
A five-word passphrase is longer and easier to remember than P@ssw0rd!. Length is what makes guessing slow.
A password manager
Nobody can remember 80 unique passwords. A manager does it for you. See choosing a password manager.
Multifactor authentication
Even a leaked password isn’t enough on its own. Turn it on everywhere, starting with email. Here’s how to set up MFA in Microsoft 365.
Sources: Have I Been Pwned: Pwned Passwords.
For businesses
One Leaked Password Can Open the Whole Office
Staff reuse work passwords on shopping and social sites. When those sites leak, the same password often opens your Microsoft 365 account.
The fix is simple and cheap: a company password manager, MFA on every account, and moving to passkeys where you can.
Frequently asked questions
Password Checker FAQs
About how the checker works and what to do next.
Is it safe to type my password into this checker?
Yes. The password is never sent anywhere. Your browser turns it into a SHA-1 fingerprint and sends only the first 5 characters to Have I Been Pwned, which returns every leaked fingerprint starting with those characters. The comparison happens on your device. If you’d still rather not, check an old password you’ve already changed.
My password was found. What should I do?
Stop using it everywhere it’s used, starting with email and banking, and use a different password for each account. Turn on multifactor authentication. If it’s a work password, tell your IT provider.
It wasn’t found. Is it safe?
Not necessarily. It only means it isn’t in the breach lists. A short password, or one you use on several sites, is still a risk.
What makes a strong password?
Length and uniqueness. A passphrase of five random words is strong and easy to type. A random 20-character password is even stronger, and fine if a password manager remembers it for you.
Is the generated password stored?
No. It’s created in your browser with a secure random number generator and disappears when you leave the page.
Should we use passkeys instead?
Where your services support them, yes. Passkeys can’t be typed into a fake website, which stops most phishing. Read our guide to passkeys.
Password security for your team
Get Every Staff Account Off Reused Passwords
We roll out a business password manager, MFA and passkeys for Edmonton offices, with short training so staff actually use them.
780-318-0149
Edmonton, AB · serving the Edmonton region