Weak means guessable
Vallkey uses zxcvbn, which looks for dictionary words, names, dates and keyboard patterns instead of counting symbols. An item's own title and username count as guesses, so Northwind2024 is weak for Northwind.
Security dashboard
See every password that needs attention.
Security checks every password you use and lists the ones in known breaches, reused between sites, easy to guess, or sent without https. Three of the four checks never leave your device.
How it works
Security dashboard, step by step.
Open Security
A tab in the browser extension and a view in every app. It checks every item in use that has a password.
Check for breaches
The breach check runs only when you ask. After that it looks again by itself as you change passwords, until Vallkey locks.
Fix what it finds
Change password opens each site's own change page. Save the new password, and the item leaves the list.
The details
What careful people ask.
Reused
Two or more items with the same password. A breach at one site gives away the password to the others.
No https
A saved website that starts with http://, where the password crosses the network unencrypted. Addresses on your own computer aren't flagged.
What it leaves out
Items in the Archive and in Recently Deleted, and passwords kept in custom fields. Two items for the same account count as a reused password.
Availability
Where you get it.
- Plans
- Free, Premium, Families, Business
- Platforms
- Every app
Questions
Does Vallkey send my passwords anywhere?
No. The weak, reused and no-https checks run on your device with no network. The breach check sends five characters of a hash, which about 800 breached passwords share, so the service learns neither your password nor its hash.
Why doesn't the breach check run by itself?
So nothing leaves your device until you choose. Once you click Check for breaches, it keeps itself current until Vallkey locks.
Related
Your passwords. Your keys. Your price.
Vallkey opens soon. Join the waitlist to hear first.