Password checker
Analyse the strength of one or many passwords against your own rules and see, rule by rule, what each one meets.
How to check your passwords
Each password is compared with the rules you choose (length, character types, repetitions, sequences, forbidden words and a built-in list of very common passwords) and gets an entropy estimate. Everything happens in your browser; an external service is queried only if you tick the breach check, and never with the password itself.
Type a password, paste a list (one per line, with an optional label) or load a TXT, CSV or Excel file.
Pick a rule preset (Basic, Recommended per NIST or Strict) or adjust it to your policy and press Check.
Review the result: with one password you will see each rule marked as met or not and the approximate time to guess it; with a list, a table you can download as CSV or TXT (with the passwords hidden if you like).
Why use JapalTools?
Your files never leave your device
Everything happens in your browser. Documents are never uploaded to any server, so you can use it with payslips, contracts or ID documents.
Free, no sign-up and no watermarks
You don't need an account or to leave your email, and nothing is added to the result.
Works on any device
Computer, tablet or phone, with an up-to-date browser (Chrome, Edge, Firefox or Safari). Nothing to install.
Frequently asked questions
No. Rules, entropy and duplicates are computed in your browser. Only if you tick “Also check whether they appear in known data breaches” is Have I Been Pwned queried, and all that is sent are the first 5 characters of each password's SHA-1 hash, which hundreds of different passwords share.
It is a rough measure, in bits, of how hard it would be to guess: it starts from the size of the character set used and discounts repetitions, keyboard sequences, known words and variants of common passwords. Each extra bit doubles the attempts needed. It is only a guide: it does not know an attacker's dictionaries or whether the password is a well-known phrase.
Because the NIST guidelines (SP 800-63B) advise against forcing character-type mixes: they tend to produce predictable passwords such as “Summer2024!”. They recommend length, allowing long phrases and rejecting common passwords, sequences, repetitions and words related to the service, which is what that preset does. You can require any character type with your own rules.
They define what you consider an acceptable password. If you run a company or a service, enter your policy (for example, 12 characters and a number) and check at once which passwords do not meet it. If you only want to know whether your password is good, keep Recommended (NIST): with one password you will see all its rules marked with ✓ or ✗.
From the estimated entropy: it is the average time an attacker who had the password's hash would need, trying 10 billion combinations per second on a powerful computer. It is only a guide: a common or leaked password is guessed instantly even if the figure is high, and a service that limits attempts protects it far more.
JapalTools wrote it: about 300 passwords and words that recur worldwide (123456, qwerty, password, names, teams, “iloveyou”…) in several languages. It also catches variants with digits or symbols at the start or end and substitutions such as @ for a or 0 for o. It is short on purpose; to compare against hundreds of millions of real leaked passwords, tick the Have I Been Pwned check.
No. The document is processed in your own browser and is not sent to JapalTools or anyone else. When you close the page, no copy remains outside your device.