Check a password: strength, how long brute force would take, weak spots (common passwords, qwerty, years) and whether it appeared in breaches, via the k-anonymity protocol that never sends the password.
Everything runs in your browser: nothing you enter is sent anywhere.
How the breach check works
The browser computes the SHA-1 of the password and sends only the first 5 characters of the hash to Have I Been Pwned. The reply lists every hash with that prefix and the comparison happens on your side: neither the password nor its full hash leaves your device. The strength score is approximate: it knows the character set and common weak patterns, not your dog’s name. Need a new one: password generator.