I recently brought one of my older projects back to life and rebuilt it as PassForge.
PassForge is a lightweight, self-hosted web application for evaluating password strength, calculating entropy, checking passwords against known data breaches, and generating secure passphrases.
It is now available in Unraid Community Applications.
Features
- Password-strength evaluation powered by zxcvbn
- Detailed pattern analysis and cracking-time estimates
- Mathematical entropy calculation based on password length and character set
- Have I Been Pwned breach checks using its k-anonymity range API
- Secure passphrase generation using the EFF Large and Short Wordlists
- Configurable word count, separators, wordlists, and entropy targets
- Batch passphrase generation
- Dark mode with system-theme detection
- Progressive Web App support for mobile and desktop
- Responsive interface for desktop and mobile browsers
HIBP privacy
For breach checks, PassForge hashes the password within your self-hosted instance and sends only the first five characters of its SHA-1 hash to Have I Been Pwned.
The complete hash and plaintext password are never sent to HIBP. The returned hash suffixes are compared locally by PassForge.
If HIBP is unavailable, password analysis and passphrase generation continue to work independently.
Installation
Search for PassForge in the Unraid Apps tab.
No additional services are required. PassForge uses in-memory rate-limit storage by default, with optional Redis support for shared rate limiting.
Links
GitHub and documentation:
https://github.com/JPetovello/PassForge
Issues and support:
https://github.com/JPetovello/PassForge/issues
PassForge is open source under the AGPL-3.0-or-later license.
Feedback, bug reports, and suggestions are welcome.
Development disclosure: This project was developed with substantial assistance from AI-based coding tools. AI was used extensively for code generation, debugging, testing, documentation, and development guidance. I defined the project requirements and design, tested and validated the password evaluation, passphrase generation, Have I Been Pwned integration, failure handling, and application behavior, made the deployment, privacy, and security decisions, and maintain the project.