Password strength checker

Need a new one? Generate a password

Transparency

Your password never leaves this page. It is analysed in your browser by the scripts listed below, and by nothing else.

Enforced by your browser
This page's Content Security Policy forbids any network request and any form submission (connect-src 'none'; form-action 'none'), so even a bug could not send your password anywhere. You can read the policy at the top of the page source.
What is stored
No cookie, and nothing in the address. The password is never stored, and the field is emptied when you leave the page. Only your language choice, if you make one, is kept in this tab's sessionStorage until you close it. Like any website, the server records the download of the page and its files in its access logs (IP address, date and time, address requested, browser name). It never receives your password.
Code that runs here
  • app.js: the strength checker, written for R-no Toolbox. Not minified. 7.7 kB
    SHA-256 1428e0a69fa92c38c5d4f4f6dc048cc0e2c093983fd70f2ca044f30c5c8c3e89
  • zxcvbn.js: the zxcvbn-ts strength estimator (core 4.2.0), with its common, English and French dictionaries and its English and French messages. MIT License. Not minified. 2.4 MB
    SHA-256 53702cbd5708ffaf67d6af89dc85740abf62ef9d342c834501c7319d34028a3c
  • textes.js: the French text of this page. It only defines texts, with no logic. 6.6 kB
    SHA-256 da5561c0d0cb1cc4727c60226673b75a62c81b49582cb395c1b112bc1cde3932
  • /commun/langue.js: the language switcher, the same on every page of the site. It reads and writes only the language choice. 5.7 kB
    SHA-256 a41e6774538ae00aa6535d4ac2e7b482dd9134c7dcd2e0d9a1bf41b35b673ae7
  • zxcvbn.LICENSES.txt: every package bundled in zxcvbn.js, with its version and full license. The English and French word lists come from OpenSubtitles 2024 via OPUS (ODC-BY).
Where zxcvbn.js comes from
It is built from pinned npm packages, whose integrity npm checks against the lockfile. On every deployment it is rebuilt from scratch and compared byte for byte with the file served here; the deployment stops if they differ.
Check it yourself
Download a file and compare its fingerprint with the one above:
curl -s https://r-no.fr/passwords/strength/app.js | shasum -a 256
Limits
This is an estimate, not a guarantee. It recognises common passwords, English and French words, names, keyboard patterns, dates, sequences and repetitions, but not your personal details. Only the first 64 characters are analysed. It does not check whether the password appeared in a data breach: that would mean sending something about it over the network.
Source repository
The R-no Toolbox repository is private. The files listed above are the complete tool, exactly as your browser runs it.