Features

Built to answer one question well: is this password safe to use? Everything runs in your browser.

Breach check (free)

• Paste or type a password, press Check.
• Shows “Seen in X breaches” or “Not found in known breaches”.
• SHA-1 hashing on your device; only a 5-character prefix is sent (k-anonymity), with padded responses.
• The field clears itself after each check. Nothing is saved.

Strength meter (free)

A zxcvbn strength score, an estimated crack time and up to four plain-English tips, like “Make it at least 12 characters”.

Password generator (free)

• Passphrases of 4 to 8 words from the EFF wordlist, easy to remember.
• Random passwords of 20 to 64 characters with every character type.
• Copy button. Your clipboard is cleared 30 seconds later.
• Uses your computer’s secure random number generator, with no bias.

Check your email (free)

Opens haveibeenpwned.com so you can check your email address there. Merlewatch never sees your email.