PassKnight

PassKnightBot, titled "PassKnight — check a password for security" on its own Telegram profile, is a small but unusually well-documented open-source project by a developer identified as Iskander (GitHub handle demureiskander). Send it a password and it does three things: checks it against the Have I Been Pwned "Pwned Passwords" corpus of more than 14 billion breached credentials, rates its overall strength on a five-dot scale based on entropy and pattern analysis, and calls out specific weaknesses — birthdays, real names, keyboard walks like "qwerty," repeated characters — before suggesting strengthened variants using techniques like leetspeak substitution or added separators.

The privacy design matches the best practice in this category: the bot's own documentation states plainly that the password "never leaves your device in plain text," because only the first five characters of a locally computed SHA-1 hash are sent to the breach-checking API — the k-Anonymity method used by haveibeenpwned.com itself. Passwords are stated to never be stored or logged, and the source code is public specifically so that claim can be checked rather than taken on trust.

It is a genuinely tiny project — one named developer, built on a modern stack (Python, aiogram, Railway), and updated as recently as the week before this review, a good freshness signal for a security tool. There is an optional Telegram Stars tip jar for supporting the developer, but the core password check itself is free. As with any unofficial security bot, there is no independent audit beyond reading the code yourself, so treat results as a helpful signal rather than a certified guarantee.