Free · Privacy-safe · No signup

Password breach checker

Check if a password has shown up in a known data breach. Your password is never transmitted — only a partial hash prefix is, using the same privacy technique as major browsers and password managers.

🔒 Your password is hashed on-device. Only a 5-character hash prefix ever leaves your browser.

Why check for breached passwords

🕵️

Breached ≠ hacked-just-now

A "found" result means that password appeared in a data breach at some point — possibly years ago, possibly from a site you've never even used. Criminals compile these into cracking dictionaries used against every login form on the internet.

♻️

Reuse is the real risk

Credential-stuffing attacks try leaked passwords against thousands of other sites automatically. A breached password is dangerous everywhere you've reused it, not just where it originally leaked.

🎲

Fix it in one step

If a password comes back breached, replace it with a long, random, unique one — our Password Generator makes one instantly, with no reuse across your accounts.

Password breach checker FAQ

Is it safe to type my real password into this tool?

Yes. Your password is hashed with SHA-1 directly in your browser and never transmitted. Only the first 5 characters of that hash are sent to the Have I Been Pwned API (k-anonymity) — that tiny prefix matches hundreds of unrelated passwords, so it's mathematically impossible to reconstruct your actual password from it.

What does it mean if my password was found?

It means that exact password has appeared in at least one known data breach and is in criminals' password-cracking dictionaries. Stop using it anywhere, especially if you've reused it across sites.

What does it mean if it was NOT found?

It isn't in the known-breached password database — reassuring, but not a guarantee of strength. A short or predictable password can still be easy to guess even if it's never leaked.

Where does the breach data come from?

Have I Been Pwned's Pwned Passwords database, compiled from real-world breaches and totaling billions of exposed passwords — run by security researcher Troy Hunt, and used by major browsers and password managers for breach warnings.