Microsoft password strength checker

Question

I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?

Answer 1

From your computer - Not any more than usual, no.

However the owner of the website you used could very easily have a copy of your password!

You shouldn't ever use an online password checker, as you have no control over where your data has gone.

As Neal stated in this answer on a very similar question:

You're unnecessarily exposing your password to some site out there on the internet! Even local applications for password checking may be nefarious. Claims that the site uses javascript and never transmits the password over the Internet cannot be trusted. Some password strength testing sites are surely run by black hats, who just add them to their dictionaries along with whatever other information they can gather about you.

Answer 2

1. If someone sniffed your network transfer (not encrypted), then yes.

2. If the website owner logs the passwords, then yes.

3. If the website itself has security holes in combination with 2., then yes.

Answer 3

I assume you're referring to the Password Checker page on Microsoft.com.

I've reviewed the HTML for that page and the JavaScript code it runs - https://www.microsoft.com/global/security/RenderingAssets/passwdcheck.js - and can ensure you that your password never leaves your computer.

On the other hand, having reviewed the JavaScript code, I can also tell you that it isn't a very good password checker (mainly because it uses a tiny dictionary).