Check whether a password has appeared in known data breaches – without ever sending the password anywhere.
🔒 Your password is hashed on your device. Only the first 5 characters of the hash are sent, so nobody – not even us – can see it.
How to use the password breach checker
- Type a password.
- Your browser hashes it and checks a range of known-breached hashes.
- If it's been leaked, change it everywhere it's used.
How can this be private?
Your browser turns the password into a SHA-1 hash and sends only its first 5 characters to the Have I Been Pwned range API, which returns hundreds of matching hashes. The comparison happens on your device (k-anonymity).
What to do if it's leaked
Change it on every account where it's used, enable two-factor authentication, and use a password manager to create unique passwords.
Frequently asked questions
Is it safe to type my password here?
Yes. The password is never sent or stored – only a 5-character hash prefix leaves your device.
Not found means my password is strong?
No – only that it hasn't appeared in a known leak. Length and uniqueness matter most.
Where does the breach data come from?
The Pwned Passwords database by Have I Been Pwned, which contains passwords from public data breaches.