Password checks

In the desktop app, you can audit your passwords for security risks:

1. Unlock your vault.
2. Open the vault actions menu at the top.
3. Select Password audit.
4. Select Run audit.

The audit runs locally and does not modify your vault data.

Weak passwords

Paw evaluates password strength using the go.lucor.dev/zxcvbn estimator:

• Scores range from 0 (weakest) to 4 (strongest).
• Passwords with a score below 3 are flagged as weak.
• Strength scores are estimated guidelines based on entropy and dictionary patterns.

Reused passwords

Paw compares passwords across items in the unlocked vault. If two or more items use the exact same password, they are grouped and flagged as reused. This check runs entirely offline on your device.

Exposed passwords

Paw integrates with Have I Been Pwned — Pwned Passwords to detect if a password appears in publicly disclosed data breaches:

• Privacy protection (k-Anonymity): Paw computes the SHA-1 hash of the password. It sends only the first 5 characters of the hash to the Have I Been Pwned API.
• Your plaintext password and the full hash never leave your machine.
• Paw compares the remaining characters of the hash locally against the list returned by the API.
• Paw includes HTTP padding in the request to prevent eavesdroppers from inferring response sizes.
• This check requires an internet connection, but it is optional. Standard vault operations never contact external servers.