Password Security FAQ
Everything you need to know about password security, entropy math, and privacy preservation with PassCheck.
Q:How does a password strength checker work?
A modern password strength checker evaluates length, character pool cardinality, Shannon information entropy, and penalizes structural patterns such as keyboard walks, sequential characters, and common dictionary roots.
Q:Does PassCheck store my password?
No. PassCheck is 100% zero-knowledge and runs entirely inside your browser memory. We never write credentials to cookies, localStorage, sessionStorage, or server databases.
Q:Can a password be strong but still be breached?
Yes. Even if a password contains 20 complex characters, if you previously used it on a website that suffered a data breach, attackers have already recorded it in wordlists. Always use unique passwords.
Q:What does password entropy mean?
Password entropy (measured in bits) expresses the mathematical unpredictability and search space of a password. Higher entropy means more brute-force attempts are required to crack it.
Q:How does the PassCheck breach check protect my privacy?
It uses the k-anonymity mathematical model. Your browser hashes the password locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. The server returns hundreds of matching hashes, and the match check occurs locally on your machine.