Security / Password Analysis
Is your password actually secure?
Analyze strength, patterns, and known breach exposure without ever storing or transmitting your password.
Security Score
Awaiting input
Estimated, based on local password characteristics.
Password Analysis
Security Score
—
Composition
Patterns
—
Entropy
—
Exposure
—
Recommendation
—
Password Generator
Generated locally using your browser's cryptographic random source. Nothing is stored.
How It Works
Strength analysis
Everything about length, character composition, repetition, and predictable patterns is calculated in your browser. Your password never leaves the page for this part of the analysis.
Breach check
- Your password is hashed locally with SHA-1.
- Only the first 5 characters of that hash are sent to Have I Been Pwned.
- HIBP returns a list of matching hash suffixes not passwords.
- The comparison against your full hash happens locally, in your browser.
- Only the result found or not found is shown to you.
Length longer passwords are generally harder to guess or brute-force.
Uniqueness reusing a password across accounts means one breach can compromise all of them.
Unpredictability names, dates, sequences, keyboard patterns, and common phrases are the first things attackers try.
Breach exposure a strong-looking password can still be unsafe if it has already appeared in known breach data.
Privacy
The short version: everything happens inside your browser, on your own device. There is no server-side code that receives, stores, or logs your data.
- What data is handled: only the password you type into the analyzer, processed in browser memory to compute a score; and, for the breach check, a partial SHA-1 hash prefix sent to Have I Been Pwned. Nothing else is collected.
- Everything is client-side: the full password never leaves the page, never goes to a server, and is cleared when you refresh or close the tab.
- Storage used: none. The page sets no cookies and uses no localStorage, sessionStorage, or IndexedDB, so there is no consent banner to show.
- The breach check uses a k-anonymity approach: only a partial hash prefix is sent to Have I Been Pwned.
- Passwords are never written to the URL, localStorage, sessionStorage, analytics, or console logs.
- Do not enter a password belonging to another person without their authorization.
Infernified provides an educational estimate of password strength and known breach exposure. Results are not a guarantee of security and should not be treated as a professional cybersecurity audit or legal advice.
Credits
Built by
With