Password Health gives you a score out of 100 that shows how secure your passwords are. Dashlane calculates your score on your device and updates your score when your logins change.
What affects your score
You get a score when you have at least five logins in your account that aren’t excluded. Excluded passwords don’t count toward your score.
In the Android app and the web version, logins without a password count toward your total number of logins. In the iPhone, iPad, and macOS apps, logins without a password don’t count.
Dashlane gives more weight to critical accounts and to compromised, reused, and weak passwords. Critical accounts include bank, email, health, social media, and online store accounts. Criminals target these accounts most often.
Update your compromised, reused, and weak passwords to raise your score. Start with your critical accounts for the biggest improvement.
If you’re on a professional plan with Spaces, you get a separate score for your Personal Space and your Business Space. You can also see a combined score for both Spaces.
Where and how Dashlane calculates your score
Dashlane calculates your Password Health score in the background, on your device. Dashlane follows a zero-knowledge principle, so only you can access your vault. Dashlane's servers don't have access to your login details.
Common questions about security at Dashlane
Dashlane security and compliance
Compromised passwords
A login is compromised if a data breach affects the login or the password appears in a list of leaked passwords. A login is also compromised when Dark Web Monitoring detects the login on the dark web. The dark web is a group of hidden websites that standard search engines don't show. Criminals sometimes use these websites to sell stolen data.
Dashlane sends a security alert if a breach occurred after you last changed your password. Dashlane also checks whether your other logins use the same or a similar password. If they do, Dashlane marks those passwords as compromised too.
Respond to an alert about a password
Leak checks that protect your password
Dashlane uses hashes to check for leaks, so the server never sees your full password. A hash function turns your password into a unique set of characters, called a hash. The conversion works in only one direction, so the hash doesn't reveal your password.
Dashlane checks your password against leaked passwords in three steps:
- On Dashlane's servers, Dashlane finds every leaked password hash that starts the same way as your password hash.
- Dashlane sends the list of possible matches, often thousands of hashes, to your device.
- On your device, Dashlane compares the full hash of your password with each hash on the list.
Checks when you save or autofill
When you add or update a password, Dashlane checks whether the password has leaked. Your login might show as compromised before you save it to your vault. After you save the password, Dashlane updates your Password Health page.
When you log in to a website, Dashlane shows whether a password is compromised, reused, or weak. You see the status in the pop-up where you choose a login to autofill. The pop-up to save or replace a login shows the status too.
Weak passwords
Cybercriminals use computers to guess passwords. The computers run brute-force attacks, which try many possible passwords until one works.
Dashlane considers a password weak if someone can guess the password with little effort. Dashlane checks password strength against more than 30,000 common passwords, dictionary words, names, keyboard patterns, dates, and more.
Dashlane uses an open-source algorithm called ZXCVBN. Most password-strength meters use ZXCVBN too. The algorithm looks for patterns that cybercriminals use to guess passwords.
ZXCVBN assigns each password a strength score from 0 to 4. The strongest score is 4, and a password with a score of 2 or lower is weak.
Reused passwords
Your Password Health score goes down when your passwords are identical or too similar. The more reused passwords you have, the lower your score.
Dashlane uses a measure called Levenshtein distance to make sure your passwords are meaningfully different. Levenshtein distance counts how many edits turn one password into another. Each edit deletes, inserts, or replaces one character.
If two passwords have a Levenshtein distance of three or lower, Dashlane considers the passwords reused.
For example, Password123! and password123 differ by two edits. The Levenshtein distance is two, so Dashlane considers the passwords reused.
Levenshtein distance definition
If you use the same username and password for services that share one account, link those websites together. Linked websites don't lower your score.
Improve your score
To raise your score, update your compromised, reused, and weak passwords. Use the Password Generator to create a unique password or passphrase for each account.
Generate a password or passphrase using Dashlane
Edit your password
Video: Change a weak, reused, or compromised password with the Password Generator