AltF Vault

Password health check

The Health tab checks every saved password on your device: weak strength scores, the same password used on more than one site, passwords unchanged for over a year, expired API keys and recovery code sets running low. An optional breach check sends only 5-character hash prefixes to Pwned Passwords. Open the vault or try the demo below to see it.

  • Free, no account
  • Encrypted on your device
  • Works offline
  • Not yet independently audited
Checking this browser for a saved vault...

What each warning means

  • Reused: one leak unlocks every account that shares the password. Fix these first.
  • Weak: the strength estimate is Fair or lower after removing credit for common patterns.
  • Over a year old: not urgent on its own, but worth rotating if it was ever shared or reused.
  • Expired key: an API key past the date you recorded. Revoke it and save the replacement.
  • Codes running low: two or fewer unused recovery codes left.

The percentage is a count, not a grade

The ring shows the share of checked items with no warning. It is not a security rating of you or your accounts, and a clean result does not prove a password is safe.

Password health check: questions and answers

Does the health check send my passwords anywhere?

No. Strength, reuse and age checks run on your device. Only the optional breach check makes requests, and it sends just the first 5 characters of each password's SHA-1 hash.

How is strength measured?

With the same estimator AltF Security uses: entropy from length and character variety, reduced for common passwords, keyboard runs, dates, repeats and symbol swaps.

Which passwords should I change first?

Reused passwords on email, banking and phone accounts, then anything found in the breach check, then weak ones.

Can I try it without saving data?

Yes. Choose Try the demo for made-up sample data with deliberate problems, then open Health.

Vault guides and features

AltF Vault homeThe vault, how it is built, what it cannot do and the FAQ.How the encryption worksThe full AltF Vault security design in plain English: PBKDF2-SHA-256 key derivation, AES-256-GCM, what is stored, and what it cannot protect against.Encrypted secure notesWrite encrypted notes in your browser: bank details, ID numbers, door codes and private lists, sealed with AES-256 on your device. Free and no sign-up.2FA recovery code storageStore two-factor backup and recovery codes encrypted on your device, tick off used codes and get warned when a set is running low. Free, no account.Encrypted backup and restoreDownload an encrypted backup of your AltF Vault, keep it in cloud storage or on a USB drive, and restore it on any device with your passphrase.Import passwords from CSVImport a password CSV from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password or LastPass into an encrypted vault. Read on your device, never uploaded.Offline password managerA free offline password manager that runs in your browser with no account or cloud. Encrypted on your device, works without internet after loading.Master passphrase guideHow to choose a master password for a password manager: random word passphrases, how many words you need, how to memorise it and what to avoid.How to choose a password managerA checklist for choosing a password manager: audits, encryption, recovery, sync, offline access, export and cost, with an honest look at where AltF Vault fits.

Free tools that work with the vault

AltFTool stores nothing from your vault. It is encrypted and kept in your browser; the only optional network request is the k-anonymity breach check.