Enter a password to see an estimated strength.
Check known breaches
When you select this button, the first five characters of the password hash are sent to an external breach lookup service. The service also receives your IP address. Your password itself is not sent.
Use the result to decide what to do next
The strength result is an estimate based on the password you enter. If it is weak, you can generate a new password. A breach lookup runs only when you select its button.
To replace it, use the password generator to create a different password for each service.
How your password is handled
Your input is processed in your browser and is not sent to or stored on Q-bic servers. Breach lookup uses an external service; the information sent is explained above its button.
We use Google Analytics to count page views. Passwords you enter or generate are not included in analytics data.
This tool does not automatically read passwords saved in Google or other accounts.
Frequently asked questions
How do strength and breach checks differ?
The strength check estimates how hard a password is to guess from its length and predictable words or patterns. The breach check looks for the same password in known breach data. These are separate checks.
Is my password sent to another service?
Strength is calculated in your browser. Only when you select Check breach data are the first five characters of its hash sent to an external service. Your password itself is not sent, but the service also receives your IP address.
Does Not found mean the password is safe?
It means the lookup service did not find this password in its data. It cannot rule out every breach or guarantee future safety. Check strength and password reuse separately.
What does estimated time to guess mean?
It is a reference estimate based on 10,000 guesses per second. Attack methods and service protections vary, so it does not tell you how long a password is safe to use.