Common Password Checker

Check for a common password

Attackers trying to break into accounts start with lists of the most common passwords, so if yours is on such a list it can be guessed almost instantly. This checker compares a password against a built-in list of the passwords that appear most often in data breaches and credential-guessing attacks, and also flags obvious patterns like all-numeric strings, repeated characters and keyboard runs. If a password is common or follows an obvious pattern, it is weak regardless of its length.

The check runs entirely in your browser against a local list, so the password you test is never sent anywhere.

Choosing a password that is not common

Being absent from the common list is only the first hurdle; a strong password must also be long and unique to each account. The most effective approach is a password manager generating a long random password for every site, or a passphrase of several random words. Avoid personal information, dictionary words and the predictable substitutions, like a zero for an o, that attackers already anticipate.

For a thorough check of whether a specific password has appeared in known breaches, dedicated breach-lookup services exist, but this local tool gives an instant privacy-preserving first screen. All checking happens locally in your browser.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.