Password Auditor
Analyze password strength and security
About the Password Auditor
This password auditor checks a password against common password patterns and structural weaknesses, then gives specific recommendations rather than a score. Everything is analysed in your browser and nothing is transmitted.
A password auditor differs from a strength meter in what it produces: named weaknesses and specific fixes rather than a bar and a colour. Knowing a password is "weak" is far less useful than knowing it is a dictionary word with a digit appended.
The patterns that matter are the ones attackers try first. A word plus a year, a name plus a birthday, keyboard runs, and the standard substitutions — @ for a, 0 for o, 3 for e — are all modelled explicitly by cracking software, so they add very little real strength.
The recommendations focus on length, because that is the lever that actually works. Adding four characters helps far more than swapping one letter for a symbol. Analysis runs entirely in your browser and nothing is transmitted — though testing a password you actively use is still best avoided on any website.
How to use the Password Auditor
- Enter a password. Type the password you want audited.
- Read the findings. See which specific weaknesses were identified.
- Apply the recommendations. Act on the suggestions, starting with length.
- Re-audit. Check the revised password to confirm the improvement.
Password Auditor features
- Named weaknesses rather than a single score
- Common password pattern detection
- Flags predictable substitutions and keyboard runs
- Specific, actionable recommendations
- Nothing typed is transmitted or stored
- Runs entirely in your browser
Frequently asked questions
How is this different from a strength meter?
It names specific weaknesses and gives fixes, rather than reducing everything to a score and a colour.
Which patterns does it flag?
Dictionary words, a word plus a year, names plus dates, keyboard runs, and predictable substitutions like @ for a.
Why do the recommendations focus on length?
Because length is the lever that works. Four extra characters help far more than swapping one letter for a symbol.
Is it safe to type a real password?
Analysis is entirely local and nothing is transmitted. Even so, avoid typing passwords you actively use into any site.
Does it check breach databases?
No. It checks patterns locally. For breach exposure, use a service built for that with a k-anonymity API.