Password Strength & Breach Auditor

Rate your password's real strength offline, then check it against billions of breached passwords without ever sending the password itself.

Password Strength & Breach Auditor is a free, single-file command-line tool from Bug Circuit that tells you two things every password owner should know: how strong a password really is, and whether it has already leaked in a known data breach. It runs on any machine with Python 3.8+. No installation, no dependencies, no account. Just download one file and run it.

The offline analysis goes well beyond a naive "length times character types" score. It combines a conservative entropy estimate with pattern detection tuned to how attackers actually guess: keyboard walks (qwerty, asdf, and AZERTY/QWERTZ layouts), ascending and descending sequences, repeated blocks, embedded dates and years, and common dictionary words, including leetspeak disguises like "P@ssw0rd". Each weakness reduces the effective score, yielding a clear rating from *very weak* to *very strong* and a rough offline crack-time estimate you can actually act on.

The optional breach check is where privacy is treated as non-negotiable. Using Have I Been Pwned's k-anonymity range API, your password is SHA-1 hashed locally and only the first five characters of that hash are ever sent over the network; the match is completed on your own machine. The password (and even its full hash) never leaves your computer, responses are padded to avoid leaking the result, and passwords are only ever read from a hidden prompt or stdin, never from the command line or any log file. Cross-platform, colorized when it helps and plain when piped, with sensible exit codes for automation, it is a small tool that does one important job carefully. Use it only on passwords and accounts you own or are authorized to test.

How to use

• Install Python 3.8 or newer (most macOS/Linux systems already have it; on Windows, get it from python.org).
• Download bugcircuit-passaudit.py from Bug Circuit and open a terminal in the folder where you saved it.
• Run 'python3 bugcircuit-passaudit.py' (use 'python' on Windows) and type your password at the hidden prompt to get an offline strength report.
• Add '--check-breach' to also test the password against billions of breached passwords using privacy-preserving k-anonymity.
• Read the rating, weaknesses, and (if enabled) breach count; anything rated weak or found in a breach should be replaced.
• For scripts or CI, pipe the password with '--stdin' and branch on the exit code (0 = good, 1 = weak or breached).

Example commands

python3 bugcircuit-passaudit.py
python3 bugcircuit-passaudit.py --check-breach
printf '%s' "$MY_TEST_PASSWORD" | python3 bugcircuit-passaudit.py --stdin --check-breach
python3 bugcircuit-passaudit.py --check-breach --timeout 20 --no-color
python3 bugcircuit-passaudit.py --help

Free · MIT licensed · Python 3.8+ · no dependencies · runs on Windows, macOS & Linux. A free tool from Bug Circuit.