Personal project

Password Checker — strength & breach analyzer

Zero-dependency Python CLI and bilingual web app: effective entropy, weak-pattern detection and a k-anonymity breach check where only 5 hash characters leave the device

Context

I rebuilt this project from scratch to show a defensive, privacy-first approach to a classic problem: how strong is a password really, and has it already leaked? Character-count formulas overrate human passwords, and most online checkers ask you to trust them with the password itself. Password Checker estimates what an attacker would actually try first, and checks Have I Been Pwned without ever sending the password.

What I built

A Python CLI (stdlib only): masked input, readable or JSON report, exit codes usable in scripts and CI
Effective entropy: dictionary words (including leet speak such as P@ssw0rd), AZERTY/QWERTY keyboard walks, sequences and repetitions are scored as an attacker would guess them
Thresholds sourced from France's CNIL (2022) and NIST SP 800-63B-4
Breach check through the Pwned Passwords k-anonymity API: SHA-1 computed locally, only the 5-character prefix is sent, response padding enabled
A bilingual (EN/FR) web interface on GitHub Pages: a TypeScript port of the engine, a pattern map that never reveals a character, and the SHA-1 hash drawn as 5 sent cells and 35 kept cells

Security choices

The password is never displayed, logged or stored; tests assert it never appears in any output
No --password option: it would leak into shell history and process arguments
Web: strict Content Security Policy allowing a single destination (api.pwnedpasswords.com), no analytics, no third-party scripts or fonts, no cookies sent
Breach check on click only — checking on every keystroke would send the prefix of every partial password
Repository hardening: protected main branch (PR + green CI required), secret scanning with push protection, Dependabot, private vulnerability reporting, Gitleaks scan of the full history

Engineering quality

Python tests

TypeScript tests

Shared test cases

both engines must return identical results

5 jobs

CI matrix

Windows + Linux, Python 3.11/3.14, Node 24

Runtime dependencies

How it works

1
Local analysis
Length and character classes give the theoretical entropy (L × log2 N).
2
Pattern detection
Common words, keyboard walks, sequences and repetitions are located — by type and position only, never by text.
3
Effective entropy
Predictable parts are re-scored (about 12.9 bits per common word) and the score follows CNIL thresholds.
4
Breach check
SHA-1 is hashed locally; only its first 5 characters are sent, and the matching suffix is searched locally.

Screenshots