# Password Vault Audit

Paste a password list or vault export to find reused passwords, duplicate logins, common passwords, short/weak entries, stale items and insecure HTTP URLs. Runs locally.

## Run it

- **CLI:** `gizza tool password-vault-audit "name,username,password,url,totp
Email,ada@example.com,P@ssw0rd,http://mail.example.com,
Bank,ada,CorrectHorseBatteryStaple!,https://bank.example.com,otpauth://totp/Bank
Shop,ada,CorrectHorseBatteryStaple!,https://shop.example.com,"`
- **Web:** https://gizza.ai/tools/password-vault-audit/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/password-vault-audit/tool.json

## Inputs

- `data` — Password list or vault export _(field)_
- `format` — Input format _(field)_
- `min_length` — Minimum safe length _(field)_
- `min_score` — Minimum strength score _(field)_
- `max_age_days` — Flag passwords older than this many days _(field)_
- `check_common` — Check bundled common-password list _(field)_
- `check_reuse` — Find reused identical passwords _(field)_
- `check_similar` — Find similar password variants _(field)_
- `check_insecure_urls` — Flag http:// saved URLs _(field)_
- `check_missing_2fa` — Flag entries with no stored TOTP secret _(field)_
- `mask_passwords` — Mask passwords in output _(field)_
- `output` — Output _(field)_

## Output

- Audit report (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `data` — Password list or vault export
- `format` — Input format
- `min_length` — Minimum safe length
- `min_score` — Minimum strength score
- `max_age_days` — Flag passwords older than this many days
- `check_common` — Check bundled common-password list
- `check_reuse` — Find reused identical passwords
- `check_similar` — Find similar password variants
- `check_insecure_urls` — Flag http:// saved URLs
- `check_missing_2fa` — Flag entries with no stored TOTP secret
- `mask_passwords` — Mask passwords in output
- `output` — Output

Example: `https://gizza.ai/tools/password-vault-audit/?data=name%2Cusername%2Cpassword%2Curl%2Ctotp%0AEmail%2Cada%40example.com%2CP%40ssw0rd%2Chttp%3A%2F%2Fmail.example.com%2C%0ABank%2Cada%2CCorrectHorseBatteryStaple%21%2Chttps%3A%2F%2Fbank.example.com%2Cotpauth%3A%2F%2Ftotp%2FBank%0AShop%2Cada%2CCorrectHorseBatteryStaple%21%2Chttps%3A%2F%2Fshop.example.com%2C&format=auto&min_length=12&min_score=40&max_age_days=365&check_common=true&check_reuse=true&check_similar=true&check_insecure_urls=true&check_missing_2fa=true&mask_passwords=true&output=report`

---

## About the password vault audit

This tool audits a whole password list or password-manager export at once. Paste a CSV, Bitwarden JSON export, or a simple one-password-per-line list and it reports the issues that matter across the vault: reused passwords, duplicate saved logins, common passwords, weak or short passwords, similar variants such as `Summer2024!` / `Summer2025!`, stale items where the export includes modified dates, and saved `http://` URLs.

Passwords are **masked by default**. Instead of echoing the secret back, findings show a short non-reversible fingerprint plus the password length, which is enough to correlate a reuse group without putting plaintext secrets into a report you might share. Everything runs locally in the browser.

### Supported input formats

- **Auto-detect** reads leading `{` or `[` as Bitwarden JSON, a multi-column header row with a password column as CSV, and everything else as a plain list.
- **CSV export** works with common Bitwarden, LastPass, KeePass/KeePassXC, Chrome, 1Password, Dashlane and generic headers. It looks for columns like `password`, `username`, `name`, `url`, `totp`, and modified-date fields.
- **Bitwarden JSON** reads `items[]`, login username/password/uris/totp, and revision dates.
- **List** treats each non-empty line as one password and uses synthetic names like `line 3`.

### Worked example

Given this CSV:

```csv
name,username,password,url,totp
Email,ada@example.com,P@ssw0rd,http://mail.example.com,
Bank,ada,CorrectHorseBatteryStaple!,https://bank.example.com,otpauth://totp/Bank
Shop,ada,CorrectHorseBatteryStaple!,https://shop.example.com,
```

the report shows the vault score, counts the three entries and two distinct passwords, and raises findings for the common/leetspeak password, the reused password shared by Bank and Shop, the insecure `http://` URL on Email, and any missing-TOTP findings if that optional check is enabled.

### Limits & edge cases

- **Up to 5000 entries per run.** Split larger exports before auditing.
- **No live breach lookup.** The common-password check uses a bundled offline list of well-known weak passwords; it does not query Have I Been Pwned or any network service.
- **Strength scores are heuristics.** They are useful for triage, not a cryptographic proof. Reuse and known-common findings should be fixed first.
- **Dates depend on the export.** Stale-password findings only appear when the source includes a revision or modified date.
- **Masking is safest.** Turning off **Mask passwords in output** can expose secrets in the report; leave it on unless you are working with test data.

## FAQ

<details>
<summary>Does this upload my password vault?</summary>

No. The web page runs the audit in WebAssembly in your browser. The pasted text is not uploaded, stored, or sent to a third-party API. The CLI uses the same local core logic.

</details>

<details>
<summary>Why are passwords masked in the output?</summary>

An audit report often gets copied into an issue tracker or chat. Masking keeps plaintext passwords out of that report while still showing when two entries share the same secret by using the same short fingerprint and length.

</details>

<details>
<summary>Can it read my password manager export?</summary>

It reads Bitwarden JSON directly and CSV exports whose header names a password column. Common column names from Bitwarden, LastPass, KeePass/KeePassXC, Chrome, 1Password, Dashlane and generic exports are auto-detected. If auto-detect guesses wrong, set **Input format** to CSV, Bitwarden JSON, or List.

</details>

<details>
<summary>Is this the same as a password strength checker?</summary>

No. A single-password strength checker scores one secret. This audit looks across a vault and finds cross-entry problems such as reuse, duplicate saved logins, password variants, insecure saved URLs, stale entries, and missing stored TOTP fields.

</details>

<details>
<summary>Does a clean report mean my passwords were never breached?</summary>

No. The bundled common-password check only catches well-known weak passwords offline. A clean report means no issue was found by these local rules; it is not a live breach-database search and cannot prove a password was never leaked.

</details>

## Related tools

- [AES cipher](https://gizza.ai/tools/aes-cipher/): Encrypt or decrypt text with AES in CBC, CTR, GCM or ECB mode and 128/192/256-bit keys, with hex/base64 I/O — in your browser. Nothing is uploaded.
- [AES Key Wrap](https://gizza.ai/tools/aes-key-wrap/): Wrap and unwrap cryptographic keys with AES Key Wrap (KW / RFC 3394, KWP / RFC 5649) using a 128/192/256-bit KEK — hex or base64, free and in-browser.
- [Age encrypt](https://gizza.ai/tools/age-encrypt/): Encrypt small text into an ASCII-armored age ciphertext with a passphrase or native X25519 recipients.
- [Age Key Generator](https://gizza.ai/tools/age-keygen/): Generate an age X25519 identity and its shareable age1 public recipient in your browser, or derive the recipient from an identity you already have.
- [Amcache Parser](https://gizza.ai/tools/amcache-parser/): Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.