Password Vault Audit
Paste a password-manager export or one-password-per-line list to spot reused passwords, duplicate logins, common or weak passwords, stale credentials and insecure saved URLs. Passwords are masked by default and the audit runs locally in your browser.
About the password vault audit
This tool audits a whole password list or password-manager export at once. Paste a CSV, Bitwarden JSON export, or a simple one-password-per-line list and it reports the issues that matter across the vault: reused passwords, duplicate saved logins, common passwords, weak or short passwords, similar variants such as Summer2024! / Summer2025!, stale items where the export includes modified dates, and saved http:// URLs.
Passwords are masked by default. Instead of echoing the secret back, findings show a short non-reversible fingerprint plus the password length, which is enough to correlate a reuse group without putting plaintext secrets into a report you might share. Everything runs locally in the browser.
Supported input formats
- Auto-detect reads leading
{or[as Bitwarden JSON, a multi-column header row with a password column as CSV, and everything else as a plain list. - CSV export works with common Bitwarden, LastPass, KeePass/KeePassXC, Chrome, 1Password, Dashlane and generic headers. It looks for columns like
password,username,name,url,totp, and modified-date fields. - Bitwarden JSON reads
items[], login username/password/uris/totp, and revision dates. - List treats each non-empty line as one password and uses synthetic names like
line 3.
Worked example
Given this CSV:
name,username,password,url,totp
Email,[email protected],P@ssw0rd,http://mail.example.com,
Bank,ada,CorrectHorseBatteryStaple!,https://bank.example.com,otpauth://totp/Bank
Shop,ada,CorrectHorseBatteryStaple!,https://shop.example.com,
the report shows the vault score, counts the three entries and two distinct passwords, and raises findings for the common/leetspeak password, the reused password shared by Bank and Shop, the insecure http:// URL on Email, and any missing-TOTP findings if that optional check is enabled.
Limits & edge cases
- Up to 5000 entries per run. Split larger exports before auditing.
- No live breach lookup. The common-password check uses a bundled offline list of well-known weak passwords; it does not query Have I Been Pwned or any network service.
- Strength scores are heuristics. They are useful for triage, not a cryptographic proof. Reuse and known-common findings should be fixed first.
- Dates depend on the export. Stale-password findings only appear when the source includes a revision or modified date.
- Masking is safest. Turning off Mask passwords in output can expose secrets in the report; leave it on unless you are working with test data.
FAQ
Does this upload my password vault?
No. The web page runs the audit in WebAssembly in your browser. The pasted text is not uploaded, stored, or sent to a third-party API. The CLI uses the same local core logic.
Why are passwords masked in the output?
An audit report often gets copied into an issue tracker or chat. Masking keeps plaintext passwords out of that report while still showing when two entries share the same secret by using the same short fingerprint and length.
Can it read my password manager export?
It reads Bitwarden JSON directly and CSV exports whose header names a password column. Common column names from Bitwarden, LastPass, KeePass/KeePassXC, Chrome, 1Password, Dashlane and generic exports are auto-detected. If auto-detect guesses wrong, set Input format to CSV, Bitwarden JSON, or List.
Is this the same as a password strength checker?
No. A single-password strength checker scores one secret. This audit looks across a vault and finds cross-entry problems such as reuse, duplicate saved logins, password variants, insecure saved URLs, stale entries, and missing stored TOTP fields.
Does a clean report mean my passwords were never breached?
No. The bundled common-password check only catches well-known weak passwords offline. A clean report means no issue was found by these local rules; it is not a live breach-database search and cannot prove a password was never leaked.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool password-vault-audit "name,username,password,url,totp
Email,[email protected],P@ssw0rd,http://mail.example.com,
Bank,ada,CorrectHorseBatteryStaple!,https://bank.example.com,otpauth://totp/Bank
Shop,ada,CorrectHorseBatteryStaple!,https://shop.example.com,"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/password-vault-audit/?data=name%2Cusername%2Cpassword%2Curl%2Ctotp%0AEmail%2Cada%40example.com%2CP%40ssw0rd%2Chttp%3A%2F%2Fmail.example.com%2C%0ABank%2Cada%2CCorrectHorseBatteryStaple%21%2Chttps%3A%2F%2Fbank.example.com%2Cotpauth%3A%2F%2Ftotp%2FBank%0AShop%2Cada%2CCorrectHorseBatteryStaple%21%2Chttps%3A%2F%2Fshop.example.com%2C&format=auto&min_length=12&min_score=40&max_age_days=365&check_common=true&check_reuse=true&check_similar=true&check_insecure_urls=true&check_missing_2fa=true&mask_passwords=true&output=reportMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.