Password Breach Checker — Has Your Password Been Leaked?
Find out whether a password has ever turned up in a known data breach — without exposing it. Your password is hashed inside your browser, and only the first five characters of that hash are sent to search billions of leaked credentials. If it appears, you will see how many times, so you can stop reusing a compromised password and switch to a unique one before an attacker does.
Your password stays in this browser. It is hashed locally with SHA-1, and only the first 5 characters of that hash are sent to look up matches (k-anonymity).
No check yet
Enter a password and check whether it has appeared in known data breaches.
Local strength
—
A rough estimate from length and character variety, calculated in your browser.
The count is how many times this exact password has been seen in breach data — not how many accounts of yours are affected.
How to use
- Type the password you want to check into the box — it stays in your browser.
- Click “Check password.” Your browser hashes it locally and sends only a short, anonymous prefix.
- Read the verdict: whether the password was found in known breaches, and how many times.
- If it was breached, change it everywhere you used it and choose a strong, unique replacement.
Features
- k-anonymity: only a 5-character hash prefix ever leaves your browser, never the password
- Searches billions of real leaked passwords via the Have I Been Pwned range API
- Clear breached / not-found verdict with the exact number of times it was seen
- Bonus local strength meter based on length and character variety
- No sign-up and no storage — nothing about your password is logged
Frequently asked questions
Is it safe to type my password here?
Yes. Your password is never sent anywhere. It is hashed with SHA-1 inside your browser, and only the first five characters of that hash are transmitted. That short prefix matches hundreds of different hashes, so it cannot reveal your password — this is called k-anonymity.
How can it check my password without receiving it?
The browser sends the 5-character prefix and gets back every breached-hash suffix that shares it. Your browser then looks for its own full hash in that list locally. The server only ever sees an anonymous prefix, never the password or the complete hash.
My password was found in a breach — what should I do?
Stop using it immediately, everywhere. Pick a new, unique password for each account, ideally generated and stored by a password manager, and turn on two-factor authentication where you can. A breached password is dangerous mainly because attackers try it across many sites.
Does “not found” mean my password is safe?
Not entirely. It means the password has not appeared in the breaches collected so far. A short or common password can still be easy to guess, and reusing even an unbreached password across sites is risky. Treat this as one signal, not a guarantee.
Where does the breach data come from?
From the Have I Been Pwned “Pwned Passwords” dataset, which aggregates passwords exposed in hundreds of real-world data breaches into a searchable set of hashes with occurrence counts.