Breach auditor & strength lab

Why k-anonymity keeps you safer here When you test a password against billions of leaked records, the naive approach would upload the password or full hash to a server. That design fails zero-knowledge privacy: the operator could log, replay, or infer secrets. PassGuard.io follows the industry pattern used by Have I Been Pwned: your browser computes SHA-1 locally, sends only the first five hexadecimal characters of that hash, and receives a "bucket" of possible hash suffixes. Thousands of different passwords share the same five-character prefix, so the service cannot know which password you typed. Your browser then completes the match. The plaintext never traverses the network, and our static site never sees it either—we do not operate a password API. The only third-party call is to Cloudflare-hosted Pwned Passwords ranges, which are read-only breach corpora, not an authentication endpoint. NIST Special Publication 800-63B discourages naive composition rules ("must include a symbol") in favor of long, memorable secrets and user-chosen passphrases. That is why our meter privileges length (12–64 characters is the sweet spot we highlight) and penalizes membership in a frequency list of the hundred thousand most common passwords loaded from a static file—not a cloud lookup that exfiltrates your entry. The "quantum-ready" time-to-crack readout is deliberately illustrative. Quantum computers do not magically break all passwords, but they change planning horizons for cryptography. We show two bracketing models—an aggressive classical cluster rate and a hypothetical quantum-equivalent rate—so you can reason about orders of magnitude, not exact minutes. Finally, diceware-style passphrases draw random words from the 7,776-word EFF large wordlist using `crypto.getRandomValues` with rejection sampling to avoid modulo bias. Each word contributes roughly 12.9 bits of entropy; six words is often stronger than eight random printable ASCII characters that humans handicap with patterns. This page is educational. If a password is critical, rotate it if leaked, use a password manager, and enable phishing-resistant MFA—not reuse across sites.