Password breach check

See if a password has appeared in a known data breach

Your password never leaves your browser. We hash it locally (SHA-1) and only send the first 5 characters of that hash — via our own server — to Have I Been Pwned's Pwned Passwords database, a privacy technique called k-anonymity. There's no way for anyone to reconstruct your password from that.

How k-anonymity keeps the password private

  1. Your browser turns the password into a SHA-1 hash, for example 5BAA6….
  2. Only the first 5 characters of that hash are sent. Hundreds of different breached passwords share any given prefix.
  3. Have I Been Pwned returns all the hash endings that start with those 5 characters.
  4. Your browser compares them with the rest of your hash locally. The password — and even its full hash — never leaves your device.

If it was found

Stop using that password everywhere. The number shown is how many times it appeared in breach data; even once is enough, because attackers try these lists against every login page (credential stuffing).

Not found doesn’t mean strong

A password that never leaked can still be easy to guess. Check how long it would take to crack, or generate a strong one, with the password generator & strength check.