# Vault health check — weak & reused passwords, no upload

> Free password audit: scan a KeePass .kdbx vault for weak, reused, empty, and stale passwords plus 2FA coverage, with an overall health score. Runs in your browser, no upload.

Scan a KeePass (.kdbx) vault for weak, reused, empty, and stale passwords, plus how many entries have 2FA, and get an overall health score. The analysis runs in your browser with zxcvbn, and no password is uploaded or sent to any breach service.

A password manager only helps if what's inside it is actually strong and unique — and most vaults accumulate weak, old, and duplicated entries over years. This health check gives you the objective picture: a score plus a triaged list of exactly which entries to fix.

It runs offline on purpose. Breach-lookup services can be useful, but they require sending something derived from your passwords to a third party; keeping the audit local means you get the reuse and strength analysis with zero exposure.

Fix findings by generating replacements with the Password Generator, then re-open the file anytime in the Vault Manager to confirm the score improved.

## How to

1. **Open the vault.** Load your .kdbx with its master password.
2. **Run the audit.** Every entry is scored for strength, reuse, age, and 2FA.
3. **Review findings.** See grouped issues and the overall health score.
4. **Fix and re-save.** Update weak or reused entries and save the vault back.

## FAQ

### What does the audit check for?

Weak passwords (via zxcvbn), passwords reused across entries, empty or placeholder passwords, stale ones that haven't changed in a long time, and which accounts lack a 2FA secret.

### Does it check my passwords against breach databases?

No — and that's deliberate. Online breach checks require sending a hash of your password out; this audit is fully offline, so nothing about your credentials leaves the device.

### Why does reuse matter so much?

A reused password turns one site's breach into a break-in everywhere you used it. The audit surfaces reuse clusters so you can prioritise changing those first.

### Is my vault uploaded to audit it?

No. The vault is decrypted and analysed entirely in this browser tab; the report is generated locally and discarded when you leave.


## Related tools

- [Vault Manager](https://www.safepaper.app/passwords/password-manager)
- [Password Generator](https://www.safepaper.app/passwords/password-generator)
- [Password strength](https://www.safepaper.app/security/password-strength)
- [Import & Export](https://www.safepaper.app/passwords/import-export)

---

Canonical HTML: https://www.safepaper.app/passwords/password-audit
Markdown: https://www.safepaper.app/passwords/password-audit.md

There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check.