Predictable variations
- Input
- Password1, Password123!, P@ssword
- Expected output
- Continuam em listas de ataque de dicionário
Meeting the "complexity rule" is not the same as being unpredictable.
Carregando ferramenta… / Loading tool…
is the password "password" leaked
Using the word "password" as your password is one of the internet's most repeated mistakes. See the real breach-database result, computed in your browser, without the full password ever being transmitted to any server.
Meeting the "complexity rule" is not the same as being unpredictable.
Length and randomness matter more than forced symbols.
52,372,427 is the number of times this exact password has already shown up in breaches cataloged by HIBP.
No. The full password never leaves your browser. It is turned into a SHA-1 hash locally, and only the first 5 characters of that hash (out of 40 total) are sent to the Have I Been Pwned API. It is mathematically impossible to reconstruct the original password from that prefix.
Rarely. "password1", "password123" and similar variations are also among the most common breached passwords ever, because it's the first obvious tweak anyone (and any attack wordlist) would try.
It is a break-in attempt that tries real, common or previously breached words before (or instead of) trying every possible character combination, much faster than pure brute force against most human-chosen passwords.
Because short numeric sequences tend to get suggested by default (or typed carelessly) in even more systems and forms than the word "password" specifically, but the gap between 210 million and 52 million still leaves both firmly on the list of the world's worst passwords.
It is a privacy hardening documented by Have I Been Pwned itself: it makes the API pad the response to a near-uniform byte size, so someone observing network traffic cannot guess which hash prefix was queried just from the response size.
The check uses Have I Been Pwned's Pwned Passwords database, with billions of passwords from real breaches. Your password is hashed right here in your browser, and only a small piece of the hash is ever queried.
The password is turned into a SHA-1 hash right on your device, using the browser's Web Crypto API. Only the first 5 characters of that hash (not the password, not the full hash) are sent to the API. The API returns every hash that starts with that prefix, and the comparison against the full hash happens locally, in your browser. This method is called k-anonymity and is the same one used by the official Have I Been Pwned website.
No password or full hash is ever sent, stored or logged by J-Kit. The lookup uses Have I Been Pwned's public Pwned Passwords API directly from your browser.