Password Breach Checker

This checker tells you whether a password appears in Have I Been Pwned's list of passwords exposed in real data breaches, and how many times. The password itself never leaves your browser. For example, password123 has turned up 2,266,543 times, so it is one of the first guesses any attacker tries.

Here is how the check stays private. Your browser runs the password through SHA-1, which turns it into a 40-character code called a hash. Only the first 5 characters of that hash are sent. The service replies with every breached hash that starts with those 5 characters, usually around 2,000 of them, plus some random padding rows. Your browser then looks for the full match on its own. This method is called k-anonymity: the service never learns which password you checked. The result shows the exact 5 characters that were sent.

A match means the password is known to attackers. Stop using it, even if it looks complex, and change it on every site where you used it. No match is good news, but it does not prove the password is strong. A password that has never leaked can still be short or easy to guess. Test that side with the Password Strength Checker, or make a fresh one with the Password Generator.

The data comes from the Pwned Passwords service run by security researcher Troy Hunt. It holds passwords from breaches that were made public, so a very recent or private leak may not be listed yet. The lookup is free and has no rate limit. It runs only when you press the button, never while you type.