Password security, done right

Make every password actually strong.

Free, in-browser tools to measure strength, catch breached passwords, and generate strong ones — and a developer API to put the same checks inside your app. Passwords never touch our servers.

Try the free tools Explore the API

100% client-side tools
k-anonymity breach lookup
Open source

Live analyzer offline

Analyzing…

Guesses to crack

—

Offline crack time

—

Runs entirely in your browser. The breach check sends only the first 5 characters of a SHA-1 hash.

Free tools

Three tools. Zero data collected.

Everything below runs in your browser. No account, no logging, no password ever leaving the page.

Strength analyzer

Real entropy and crack-time estimates from the zxcvbn engine — not a naïve character-count meter.

Open tool

Breach check

Match against 900M+ leaked passwords via k-anonymity. Only 5 hash characters ever leave your device.

Open tool

Secure generator

Cryptographically strong passwords and diceware passphrases from the Web Crypto CSPRNG.

Open tool

For developers

The same checks, one API call away.

Stop shipping regex password rules. Add real strength scoring, breach screening, and NIST-aligned policy validation to your signup and reset flows with a single REST endpoint.

POST /v1/strength Score a password with zxcvbn
POST /v1/breach k-anonymity breach lookup
POST /v1/validate NIST 800-63B policy check
POST /v1/generate CSPRNG password + passphrase

Get an API key Read the docs

validate.sh

# Screen a password at signup — strength + breach + policy
curl https://www.passwordify.xyz/api/v1/validate \
  -H "X-API-Key: pk_live_â€¦" \
  -H "Content-Type: application/json" \
  -d '{"password":"Summer2024!"}'

# â†’ 200 OK
{
  "valid": false,
  "score": 2,
  "breached": true,
  "breachCount": 3529,
  "violations": ["found_in_breach"]
}

Why Passwordify

Built on the modern security consensus.

Privacy by construction

The free tools never send a password anywhere. Breach checks use k-anonymity — a 5-character hash prefix, padded so response size leaks nothing.

NIST 800-63B aligned

Validation follows current guidance: check length, screen against breach corpora, and drop the outdated rules — no forced composition, no periodic expiry.

Real strength estimation

Powered by zxcvbn — pattern, dictionary and keyboard-walk aware. It catches “P@ssw0rd!” that a regex meter happily calls strong.

One integration, four checks

A single REST API for strength, breach, policy and generation. Ship the exact experience from these tools inside your own signup flow.

Give your users passwords worth trusting.

Start free with the browser tools, then wire up the API when you're ready to protect real accounts.

Get your API key See pricing