password audit function, is the display in Keepassium really reliable?

[PRhodan]

Hello,
in Keepassium there is a password audit function.
In KeePass there is a item Quality in Bits.
Sometimes it happens, that Keepassium shows a weak quality, but KeePass shows a very strong quality.
According to the description in Keepassium, the online service “Have I Been Pawned” is used for the check.
Is the display in Keepassium really reliable? Because your actual passwords are never passed on to the online service.
Regards

[keepassium]

The question seems to mix up two different features: password quality estimation and password audit (both described here).

Password audit indeed depends on "Have I Been Pwned" service. It answers the question "How many times this password can be found among known leaked credentials?" The answer does not say anything about password quality, only whether this particular password has been entered to a phishing page or such. This is a precise result returned by the online service, so you will get the same answer from different apps.

In turn, password quality estimation works locally on device and tries to guess how complex the password is per se. There is no way to calculate this precisely, since we usually don't know how the password was generated. Instead, the estimation algorithm relies on certain assumptions which vary for different algorithms.

• KeePassium, KeePassXC, Bitwarden, 1Password and a few other apps use the well-known zxcvbn library.
• KeePass uses a self-made algorithm, based on different assumptions and thus producing different results.

Either algorithm can be tricked to misrecognize a weak password as a strong one. But if any of them says the password is weak, you should definitely change it.

[PRhodan]

Thank you for the detailed answer.
I will just change my PW.

However, it is not clear to me how my PW can be considered bad if my PW is of course (hopefully) never sent to “Have I Been Pwned”.
Are partial hashes or is even the correct hash sent to “Have I Been Pwned”?
If the correct hash is sent to “Have I Been Pwned”, then the situation is of course clear.

[keepassium]

how my PW can be considered bad if my PW is of course (hopefully) never sent to “Have I Been Pwned”.

There is no need for online service to recognize weak passwords. For the "how", I will refer you to the presentation of Daniel Lowe Wheeler, the person who created the zxcvbn library: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler