// HUB / ACCOUNTS
Account & Password Security
Check whether your email address appears in a known data breach, and generate strong, unique passwords that stand up to cracking and credential stuffing.
// Tools in this section
// Why breached credentials are the biggest account risk
Most account takeovers do not involve anyone hacking you directly. They start with a breach at a company you once signed up with, whose stolen email-and-password pairs are then tried automatically against hundreds of other sites. That technique — credential stuffing — works purely because people reuse passwords.
The defence has two halves, and both are needed. The first is knowing which of your addresses have been exposed, so you can act on the accounts that matter. The Email Breach Check matches an address against publicly catalogued breach datasets. It is worth being precise about what that means: it searches known, already-indexed breach collections, not the entire dark web, and a clean result is not proof that an address was never exposed.
The second half is making an exposure harmless. If every account has a different password, a breach at one service tells an attacker nothing about the others. The Password Generator creates random passwords in your browser using the operating system's cryptographic random number generator, and shows the resulting entropy in bits so you can see how much guessing work a password actually represents.
Length matters far more than complexity. A 16-character random password drawn from letters, digits and symbols is beyond brute force with any foreseeable hardware, whereas a short password with a substituted character or two falls to a dictionary attack in seconds. Because nobody can memorise dozens of long random strings, a password manager is the practical way to use them: you remember one strong passphrase, and it remembers the rest.
Then add two-factor authentication wherever it is offered, ideally an authenticator app or a hardware key rather than SMS. It means a stolen password on its own is not enough to get in.
// Frequently asked questions
- My email appeared in a breach — what should I do first?
- Change the password on the breached service, then change it anywhere you reused it, because that is where the real risk lies. Turn on two-factor authentication for your most important accounts — email first, then banking — and move to a unique password per site.
- Does appearing in a breach mean my password is public?
- Not always. Some breaches expose only email addresses, others expose password hashes that may or may not be crackable, and some expose plaintext passwords. Treat any breached password as compromised — that is the safe assumption.
- What actually makes a password strong?
- Unpredictability and length. Strength is measured in bits of entropy: 16 random characters from a mixed pool is around 100 bits, far beyond brute-force range. Personal details, dictionary words and predictable substitutions add almost nothing.
- Are password managers safe?
- Reputable ones encrypt your vault on your device so the provider cannot read it. The risk of one well-defended vault is far lower than the near-certainty of reusing passwords without one. Protect it with a long unique passphrase and two-factor authentication.
- Is the password generator sending my password anywhere?
- No. It runs entirely in your browser using the Web Crypto API. Nothing is transmitted to a server, logged or stored — refresh the page and the value is gone.