Runs in your browser · Nothing uploaded
Audit every password.
Without sharing one.
Open your password manager’s CSV export and see which accounts reuse a password, which ones are weak or variations of each other, and, if you want, which ones already leaked.
The file is read in this tab only. Passwords are never shown, stored or sent.
Your audit
Health score: 0/100
- 0accounts analysed
- 0accounts share a password
- 0weak passwords
- 0variations of another password
- ?found in data breaches
Optional: check for breached passwords
Sends only the first 5 characters of each password’s SHA-1 hash to Pwned Passwords. The comparison happens here.
Accounts to fix, worst first
How to export your passwords safely
Every password manager can export a CSV file, usually under Settings, Export or File. Export to a local folder, run the audit, then delete the file: it contains every password in plain text.
- Chrome or Edge: Password Manager, Settings, Export passwords.
- Firefox: Passwords (about:logins), the three-dot menu, Export passwords.
- Safari or the Passwords app on a Mac: the File menu, then the export passwords command.
- Bitwarden, 1Password, LastPass, KeePass: choose the unencrypted CSV export.
What the audit looks for
Reuse is the biggest risk: one leak on a small forum hands attackers the key to every account sharing that password. Variations such as Summer2024! and Summer2025! fall to the same guess with a counter. Weak passwords are flagged with the estimator from our strength test, and the optional breach check uses Have I Been Pwned’s Pwned Passwords with k-anonymity.
The audit does not judge whether a site matters to you, and it cannot see passwords you never saved. Read why reused passwords are so dangerous and turn on two-factor authentication for the accounts at the top of the list.
Password audit FAQ
Is my password file uploaded?
No. Your browser reads the file in this tab and the analysis runs in memory. The file is not uploaded, stored or added to analytics. Closing or reloading the page discards everything.
What does the optional breach check send?
For each distinct password, only the first five characters of its SHA-1 hash go to Have I Been Pwned’s Pwned Passwords API, exactly like our breach checker. The full hash and the password never leave your device.
Which exports work?
CSV exports from Chrome, Edge, Firefox, Safari (Passwords app), Bitwarden, 1Password, LastPass, KeePass and most managers that write a header row with a password column. Encrypted or JSON exports are not read.
What should I do with the exported file afterwards?
Delete it, then empty the trash or recycle bin. A CSV export holds every password in plain text, so it should never sit in Downloads, email or cloud storage.
How are weak and similar passwords detected?
Each password goes through the same estimator as our strength test. Under 45 bits is weak. Similar passwords share the same letters once digits, symbols and common swaps are removed, like Summer2024! and summer25.
More free security tools
Password generator
Random passwords, passphrases or PINs, created by the Web Crypto API on your device.
Open toolPassphrase generator
Random words you can actually remember, with the entropy of a 16-character password.
Open toolWi-Fi password + QR code
A strong WPA2/WPA3 key and a QR code your guests scan to join, with a card to print.
Open toolStrength test
See your password the way an attacker does: patterns, entropy and four crack-time scenarios.
Open toolBreach checker
Find out if a password already leaked, without ever revealing it (k-anonymity).
Open toolSuspicious link checker
Inspect a URL and its actual hostname locally, without opening the destination.
Open toolPassword policy builder
NIST, PCI DSS and CIS presets with ready-to-run Windows, Active Directory and Linux scripts.
Open toolCrack-time table
How long every length and character mix survives a modern GPU cracking rig.
Open toolCustom-rules generator
A strong password that still fits picky websites: maximum length, allowed symbols, required types.
Open toolPhishing quiz
Twelve realistic messages. Can you tell the scams from the real thing? Share it with your team.
Open toolSmall-business security checklist
Score your company's account security in five minutes and print a prioritised action plan.
Open toolTwo-factor authentication guide
Which 2FA method to choose and how to turn it on for Google, Microsoft, Apple and more.
Open tool