Password Health & Breach Check

Password Health Audit

MyPwdTool scans your vault, entirely on-device, to flag:

• Weak passwords — short, low-entropy, or easily guessable
• Reused passwords — the same password used across more than one entry
• Old passwords — entries that haven’t been changed in a long time

None of this requires any network call at all. Your passwords never leave your device for this check.

Breach check (Have I Been Pwned)

MyPwdTool can check whether a password appears in a known public data breach, using the Have I Been Pwned API. This is done with k-anonymity: your password is hashed locally with SHA-1, and only the first 5 characters of that hash are sent to the API — which responds with every breached hash sharing that prefix, and the match is completed locally. Your actual password, and even your full password hash, is never transmitted.

Two-factor authentication (TOTP) codes

MyPwdTool can store a TOTP secret alongside a login entry and generate the current 6-digit code locally, the same way a dedicated authenticator app would — no separate app needed, no code ever sent anywhere. MyPwdTool does not operate any authentication service; the secret lives only in your encrypted vault.

Passkeys

MyPwdTool can store passkey-related metadata (relying party ID, credential ID, user handle) alongside an entry, so you have a record of which of your accounts use a passkey and which device or authenticator it’s tied to. This is metadata storage for your own reference — MyPwdTool does not perform WebAuthn authentication ceremonies on your behalf. On Windows, this is currently view-and-store only, same as TOTP.

Password History

Every time a password is changed, the previous value is kept in that entry’s history (encrypted, same as everything else) so you can look it up if you ever need to know what an old password was — for example, to check an old email/password combination against a breach notice.