Open Source Password Protection
Password protection here does not mean a vault that stores your logins. It means the defensive layer around passwords: checking which credentials are already exposed in public breaches, blocking weak or previously leaked passwords before users can set them, and generating passphrases strong enough to resist guessing. All of that only works if you can run it against your own users and password data without shipping any of it to someone else. The open source tools below do the breach lookups, directory-level password filtering, and exposure auditing inside your own environment, some of them fully offline against a local copy of known-breached hashes, so finding a leaked or bannable credential never means handing that credential to a third party.
SuperTokens
Open-core user authentication with login, session management, and on-premises control of user data
pwnedOrNot
OSINT tool for checking breached email accounts and searching public dumps for passwords
xkcdpass
Flexible, scriptable passphrase generator inspired by XKCD 936
haveibeenpwned-downloader
CLI tool that downloads all Pwned Passwords hash ranges for offline checks without the k-anonymity API
Lithnet Password Protection
Active Directory password filter for breached password checks and custom complexity rules
XposedOrNot
Open-source API for real-time data breach monitoring and email exposure alerts
Our picks
These picks each cover a different piece of password defense.
Best for hardening Active Directory: Lithnet Password Protection Lithnet Password Protection is an Active Directory password filter that inspects passwords as users change them and rejects compromised, banned, or weak choices based on policies you set in group policy. It can import the Have I Been Pwned data set to block known-breached passwords and audit existing accounts against it, and passwords never leave the domain controller.
Best for offline breach screening: haveibeenpwned-downloader haveibeenpwned-downloader pulls every Pwned Passwords hash range to your own disk so you can screen passwords against known breaches without calling the k-anonymity API, keeping checks private and removing the runtime dependency on a remote service. It fetches SHA1 or NTLM hashes into one file or many.
Best for checking an address for exposure: pwnedOrNot pwnedOrNot is a command-line tool that checks whether an email address appears in known breaches through the Have I Been Pwned API, reporting each breach name, domain, and date, plus whether credentials reached public dumps. It runs on Linux, Android via Termux, or Windows through WSL.
Best for generating strong passphrases: xkcdpass xkcdpass generates memorable multiword passphrases from configurable word lists, including the EFF lists, with control over word length, separators, and case, and it reports entropy so you can judge strength. It runs entirely offline as a command-line tool or importable Python module.
Fitting the pieces to your password problem
Password protection here covers several different jobs, so name the one you actually need before comparing tools. Breach checkers like pwnedOrNot and XposedOrNot answer whether a specific email or credential already turned up in a public dump. A directory filter like Lithnet Password Protection sits inside Active Directory and rejects weak, banned, or previously breached passwords at the moment a user tries to set one. A generator like xkcdpass produces strong passphrases. And SuperTokens is a full authentication provider, login, sessions, and multi-factor, that keeps user credentials in your own database rather than a hosted identity service.
Weigh how much data has to leave your environment, since running these locally is the whole point. Some breach lookups query a remote service such as Have I Been Pwned, which is fine for checking your own address but a poor fit for screening thousands of users. The haveibeenpwned-downloader pulls the entire Pwned Passwords hash set to disk so you can screen passwords offline with no per-check API call, and Lithnet keeps its checks on the domain controller so passwords never leave the domain. For directory filtering at scale, an offline hash set is the difference between a private control and a rate-limited dependency.
Match each tool to where it will run. Lithnet is a Windows Server and Active Directory component; pwnedOrNot and xkcdpass are command-line utilities; SuperTokens deploys as SDKs plus a self-hosted core with your own database. Confirm the licensing suits redistribution if you plan to bundle any of them into a product, and check how breach lists and word files are refreshed, because a stale banned-password list slowly loses value.
Related categories
Frequently asked questions
Is password protection the same as a password manager?+
No, and that distinction matters for this category. A password manager stores and autofills your logins in a vault. The tools here do the opposite kind of work: they check whether credentials are already exposed in a breach, block weak or leaked passwords before a user can set one, and generate strong passphrases. You would often use these alongside a password manager, not instead of one.
How do I block breached passwords when users choose them?+
You need a filter that runs at the moment a password is set. Lithnet Password Protection does this inside Active Directory: it inspects each password change against compromised-password lists, banned words, and complexity rules, and rejects anything that fails. It can import the Have I Been Pwned data set for the breach check, and the whole thing runs on the domain controller, so passwords are never sent anywhere.
Do I have to send our passwords to an outside service to check them?+
No. While some checks call a remote API, you can keep everything local. haveibeenpwned-downloader pulls the entire Pwned Passwords hash set to your own disk, so screening happens offline with no per-password API call. Lithnet Password Protection keeps its checks on the domain controller. For screening more than a handful of accounts, a local hash set turns a rate-limited dependency into a private, self-contained control.
Can I check my whole company's passwords, not just my own email?+
Yes, but with different tools than a single-address lookup. pwnedOrNot checks one email address at a time against breach data, which is fine for personal use. To audit a directory, use a filter like Lithnet Password Protection, which can audit existing Active Directory passwords against compromised lists, ideally backed by a locally downloaded hash set so you are not making a network call per account.
What makes a generated passphrase strong?+
Strength comes mostly from length and from how many words are chosen at random from a large list, not from added symbols. xkcdpass builds multiword passphrases from configurable word lists, including the EFF lists, and reports entropy so you can judge the result rather than guess. A handful of truly random words is both easier to remember and harder to crack than a short, complex string.
How often do breach and banned-password lists need updating?+
Regularly, because their value decays as new breaches appear. A banned-password or breached-hash list that was current a year ago will miss recent leaks. Lithnet Password Protection includes PowerShell support to sync compromised lists from the Have I Been Pwned API, and haveibeenpwned-downloader can refresh the offline hash set on demand. Build the refresh into a schedule rather than treating the list as a one-time import.
Where does an authentication provider like SuperTokens fit here?+
SuperTokens is the login layer rather than a hygiene checker. It handles sign-up, sign-in, sessions, and multi-factor authentication, and its on-premises model keeps user credentials in a database you control instead of a hosted identity vendor. It fits this category as the place password protection is enforced at authentication time, and it can be used free with no cap on the number of users.