Audit & convert
Audit a KeePass (.kdbx) vault for weak, reused, empty, and stale passwords, plus 2FA coverage — with an overall health score. Analysis runs entirely in your browser with zxcvbn; no passwords are uploaded or checked against an online breach database.
There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to audit a password vault
- Open the vault. Load your .kdbx with its master password.
- Run the audit. Every entry is scored for strength, reuse, age, and 2FA.
- Review findings. See grouped issues and the overall health score.
- Fix and re-save. Update weak or reused entries and save the vault back.
A password manager only helps if what's inside it is actually strong and unique — and most vaults accumulate weak, old, and duplicated entries over years. This health check gives you the objective picture: a score plus a triaged list of exactly which entries to fix.
It runs offline on purpose. Breach-lookup services can be useful, but they require sending something derived from your passwords to a third party; keeping the audit local means you get the reuse and strength analysis with zero exposure.
Fix findings by generating replacements with the Password Generator, then re-open the file anytime in the Vault Manager to confirm the score improved.
Frequently asked questions
What does the audit check for?
Weak passwords (via zxcvbn), passwords reused across entries, empty or placeholder passwords, stale ones that haven't changed in a long time, and which accounts lack a 2FA secret.
Does it check my passwords against breach databases?
No — and that's deliberate. Online breach checks require sending a hash of your password out; this audit is fully offline, so nothing about your credentials leaves the device.
Why does reuse matter so much?
A reused password turns one site's breach into a break-in everywhere you used it. The audit surfaces reuse clusters so you can prioritise changing those first.
Is my vault uploaded to audit it?
No. The vault is decrypted and analysed entirely in this browser tab; the report is generated locally and discarded when you leave.
Related tools
- Vault ManagerOpen, edit, and create KeePass (.kdbx) password vaults right in your browser. Browse groups and entries, reveal and copy passwords, show 2FA/TOTP codes, and save the encrypted database back to your device. Your master password and secrets never leave this tab.
- Password GeneratorGenerate strong random passwords and memorable diceware passphrases using your browser's cryptographic RNG. Tune length, character sets, and word count, see a live strength and entropy estimate, and copy — nothing is generated on or sent to a server.
- Password strengthzxcvbn scoring
- Import & ExportImport password exports from Chrome, Firefox, Bitwarden, 1Password, or LastPass (CSV/JSON) and save them as an encrypted KeePass .kdbx vault, or export a .kdbx back to CSV/JSON. Everything is converted locally in your browser — your credentials are never uploaded.