Animated entropy bars, a real strength meter, and a genuinely private breach check
A visual password generator and strength meter with animated per-character entropy bars, crack-time estimates across four real attack scenarios, and an optional breach check against the free Have I Been Pwned "Pwned Passwords" database - using k-anonymity, so only a 5-character hash prefix ever leaves your device. Your actual password never does.
Every character in your password gets its own bar, coloured by class - lowercase, uppercase, digit or symbol - and sized by how much it contributes to your password's overall entropy. A genuinely different way to see a password than a plain progress bar.
Starts from Shannon-style entropy, then applies real penalties for common passwords, dictionary words (leetspeak-normalised), sequential runs, keyboard-walk patterns and repeated characters - so "P@ssw0rd1" doesn't score as strong as it looks.
See roughly how long a password would survive against a throttled login form, an unthrottled API, an offline slow-hash crack, and an offline GPU farm - turning an abstract "bits of entropy" number into something concrete.
Checks your password against the free Have I Been Pwned "Pwned Passwords" database. Only the first 5 characters of your password's SHA-1 hash are ever sent - the match against your full hash happens locally, so your real password never leaves the device.
Generate a random character password (choose length, and which of lowercase/uppercase/digits/symbols to include, with an option to exclude ambiguous characters), or a word-based passphrase with your choice of separator and capitalisation.
Generation uses the browser's cryptographically secure random number generator - not a simple pseudo-random function - so guaranteed-inclusion character sets and passphrase word picks are both properly unpredictable.
Every check is logged with its length, strength band, timestamp and breach result - but never the password itself, and never even a hash of it. A weak password's hash is itself reversible via rainbow tables, so storing it would defeat the entire point.
Sequential runs ("1234"), keyboard-walk runs ("qwerty"), repeated characters and repeated blocks are each flagged individually as tags, so you know exactly what's weakening a password - not just a single opaque score.
Switch between a light or dark theme that remembers your choice, so entropy bars and strength colours stay readable whatever the time of day.
No sign-up, no subscription, no ads. Everything runs locally except the one opt-in breach-check request - and even that never carries anything identifying.
This is a strength-checking and generation tool, not a vault - it deliberately doesn't store the passwords you check or generate, so there's nothing sensitive to protect, back up or lose.
Most people check password strength with a browser's basic colour-changing bar, or don't check it at all. Here's how a dedicated tool with a real breach check compares.
| Feature | Metre2 Password Strength Studio | A browser's built-in strength bar | An online password-strength website |
|---|---|---|---|
| Pricing model | Free | Free (built in) | Usually free, ad-supported |
| Pattern-aware scoring | ✓ (common passwords, dictionary words, keyboard walks) | ✕ (usually length/character-class only) | Varies |
| Breach check with k-anonymity | ✓ (only a hash prefix is ever sent) | ✕ | Rare - and rarely disclosed clearly |
| Password ever leaves your device | ✕ Never | ✕ Never | Sometimes, in full - a real risk with an unknown site |
| Built-in generator (character + passphrase) | ✓ | ✕ | Varies |
| Crack-time estimates | ✓ (4 attack scenarios) | ✕ | Rare |
General comparison as of August 2026. Not affiliated with Have I Been Pwned, any browser vendor, or any third-party password-strength website.
No, never in full. The strength meter, entropy bars and generator all run entirely on your device. The optional breach check uses k-anonymity: only the first 5 characters of your password's SHA-1 hash are sent to the free Have I Been Pwned API - never the password itself, and never the full hash.
Your password is hashed with SHA-1 locally, then only a 5-character prefix of that hash is sent to the Have I Been Pwned API. The API returns every breached hash suffix that starts with that prefix (usually hundreds), and the match against your full hash happens locally on your device. There's no way for the API, or anyone watching the request, to work out what your password actually is.
Each bar represents one character of your password, coloured by character class (lowercase, uppercase, digit, symbol) and sized by how much it contributes to your password's overall entropy. It's a quick visual way to see which parts of a password are doing the real work.
No. It starts from Shannon-style entropy based on character-pool size and length, then applies real penalties for patterns that make passwords easier to guess in practice - common passwords, dictionary words (including leetspeak substitutions), sequential runs like "1234" or "abcd", keyboard-walk runs like "qwerty", and repeated characters or blocks.
They show roughly how long a password would take to guess under four different attack scenarios: a throttled online login form, an unthrottled online API, an offline slow-hash crack, and an offline GPU cracking farm. It's a rough guide, not a guarantee - but it makes an abstract entropy number concrete.
No. History only ever stores metadata - length, strength band, timestamp and breach result - never the password itself, and never even a hash of it (a weak password's hash is itself reversible via rainbow tables, so storing it would defeat the point).