Cipher shows the real strength of a password measured in bits, the way an attacker counts guesses and checks it against known breaches without it ever leaving your browser.
Your password is SHA-1 hashed in your browser. Only the first 5 characters of that hash are sent to the API, which returns every breached hash sharing that prefix; the match is checked here, locally. The password itself never leaves this page — that's the k-anonymity model, the same one the real HIBP integration uses.
How it works
One measures strength honestly. The other checks a secret against a database without ever revealing the secret.
Strength isn't about "having a symbol." It's about how many guesses an attacker needs on average, measured in bits of entropy:
The pool grows by category — lowercase (+26), uppercase (+26), digits (+10), symbols (+~33). But length multiplies the whole thing, while adding a category only nudges the base inside a logarithm. That's why a long passphrase beats a short scramble that merely looks complex.
Asking "has this exact password appeared in a breach?" by sending the password to a server would itself be a security disaster. k-anonymity solves it:
The server never learns which password, or even which full hash, was checked — only a 5-character prefix shared by many. Elegant, and genuinely private.
About
A browser-based password auditing tool that measures password strength through entropy calculations and performs breach checks using the same k-anonymity model used by Have I Been Pwned
I'm Mohit Pawar,an aspiring cybersecurity student with a growing interest in cryptography, authentication systems, and privacy-preserving security design. My interest in cybersecurity developed through building software and exploring how security principles can be applied to everyday tools.
One project that reflects this is Cipher, a browser-based password auditing tool that measures password strength through entropy calculations and performs breach checks using the same k-anonymity model used by Have I Been Pwned. Building it required understanding concepts such as password entropy, hashing, breach databases, and privacy-preserving verification.
Built as part of a move from web development into security. Understanding why a password is weak — and how to check it safely — is more useful than a red/green meter that won't tell you its reasoning.
Cipher is plain HTML, CSS, and JavaScript: a single file, no build step, no dependencies. SHA-1 hashing uses the browser's built-in Web Crypto API.
SHA-1 is used only because it's the HIBP range API's format — as a lookup, never as password storage. Storing passwords with plain SHA-1 would itself be a vulnerability.
Entropy assumes a random password. A dictionary word with predictable substitutions has less effective entropy than the formula suggests, since real attackers guess patterns first. Crack-time is one assumed attack rate; real timelines vary with hardware and the defender's hashing choices.