Docs / Sentinel

Know which credentials need attention.

Sentinel combines local password intelligence with optional privacy-preserving breach checks.

Review findings

• Find weak, predictable, reused, old, and compromised passwords.
• Find website addresses that still use insecure HTTP.
• Open the affected vault and item without exposing the password in the report.

Local analysis

• Strength checks use local entropy and pattern analysis.
• Reuse checks compare password fields inside 9Core, so plaintext passwords never cross the app boundary.
• Age and insecure-website checks remain available without a network connection.

Breach checks

• Sentinel sends only the first five characters of a password hash to the Have I Been Pwned range service.
• The complete hash and the password never leave your device.
• Requests use response padding to reduce information leakage.
• Online checks can be disabled without disabling local findings.

Run audits

• Run a complete audit manually whenever you want.
• Choose every unlock, daily, weekly, monthly, or off for scheduled audits.
• The default schedule is weekly.
• Results and last-checked times are cached inside the encrypted vault index.

Generated passwords

• Cryptographically generated passwords of at least 12 characters are accepted immediately during generation.
• Complete audits still re-check every stored password, including generated passwords.