100% freeNo sign-upsNo trackingKeeps working with the internet off
Six questions about how you use passwords, set against the guidance of the National Cybersecurity Alliance, which leads Cybersecurity Awareness Month with the United States Cybersecurity and Infrastructure Security Agency.
The short answer. This page asks six yes or no questions about your password habits and sets your answers against the National Cybersecurity Alliance's guidance on length, reuse, password managers, a second check and when to change a password. You type no password, and nothing leaves your device. It reflects guidance and cannot see your accounts.
How it works, in four steps
Paste or chooseChoose answers to six questions. You never type a password.
The check runs on your own phone or computerWhat you add stays on your device, and the page keeps working with the internet off.
Read what it found and what to do nextSee which habits to look at and what to change first.
What this check cannot doIt cannot see your accounts, or tell whether a password has already been exposed in a breach.
is the minimum length the National Cybersecurity Alliance recommends for every password, with a different one for every account.
National Cybersecurity Alliance, 25 February 2026. Read the article
You type nothing on this page. You tap Yes, No or Not sure, and what you tap stays on your phone. Turn the internet off and this page still works. UtilForge will never ask for a password, and neither should any website that offers to test one: a password typed into a testing site is a password shared.
Question 1 of 6
Change one habit at a time. Start with the account that would cause the most harm if someone else opened it, which is usually your email, because email can reset the others. The guide to strong passwords and password managers explains each step, and the guide to two-step login covers the second check.
This check reflects guidance, not your accounts. UtilForge cannot see your passwords, and no answer here shows that an account has been or will be taken over.
What this cannot do
This check looks only at the habits you tick. It cannot see your accounts, tell whether a password has already been exposed in a breach, or confirm that your accounts are safe. A good result is not a guarantee.
Questions people ask
Who made this?
UtilForge makes it. UtilForge is a website of free cybersecurity tools. The About page explains why the tools were made, and the Contact page is the way to reach us.
Is this a scam site?
You do not have to take our word for it, because you can check. This page does not ask for payment, a sign-in or card details. It is set so that your browser stops the page sending anything off your phone or computer, and you can test that: let the page finish loading, switch the internet off, then use it. It keeps working, because it has nowhere to send anything. If you are still unsure about any website, do not type anything private into it. UtilForge also sells optional packs of tools through Gumroad, and nothing on this page needs one.
What happens when I close the page?
Your answers are gone. It saves nothing in your browser and puts nothing in the web address of the page. The page has no text box, no save button and no download button, so it holds no password and leaves no file on your device.
Does it cost anything, and do I need to sign in?
It is free, and you can start straight away. UtilForge also sells optional packs of tools through Gumroad, and nothing on this page needs one.
What does the check do?
It asks six yes or no questions about how you use passwords and sets your answers against the guidance of the National Cybersecurity Alliance: at least 16 characters, a different password for every account, a random mix, a password manager, a second check, and changing a password only when there is a reason. It points out which habits to look at, and it cannot see your accounts.
Do I type my password anywhere?
No. UtilForge never asks for a password, and neither should any website that offers to test one, because a password typed into a testing site has been shared with it.
Is it saying my passwords are weak?
No. It has no way to know, because it never sees them. It reports which habits match published guidance and which are worth another look.
Where does the guidance come from?
From two National Cybersecurity Alliance articles, dated 25 February 2026 and 18 May 2026, and from the United States standards body National Institute of Standards and Technology, in its publication SP 800-63B revision 4 of 26 August 2025. The guide to strong passwords and password managers lists each source.
Tell UtilForge what worked and what did not. Each button opens an email to lindsay@utilforge.org that you write and send yourself. UtilForge will only quote your words on this site if you say it may, and then with your first name and country only.
The whole method in one book. “How to Become Safer Online” is a free large-print guide to the five steps most scams follow, and what to do if money or details have already gone. Read or print the free book.