Free · Privacy-safe · No signup

Password breach checker

Check if a password has shown up in a known data breach. Your password is never transmitted — only a partial hash prefix is, using the same privacy technique as major browsers and password managers.

🔒 Your password is hashed on-device. Only a 5-character hash prefix ever leaves your browser.

Why check for breached passwords

🕵️

Breached ≠ hacked-just-now

A "found" result means that password appeared in a data breach at some point — possibly years ago, possibly from a site you've never even used. Criminals compile these into cracking dictionaries used against every login form on the internet.

♻️

Reuse is the real risk

Credential-stuffing attacks try leaked passwords against thousands of other sites automatically. A breached password is dangerous everywhere you've reused it, not just where it originally leaked.

🎲

Fix it in one step

If a password comes back breached, replace it with a long, random, unique one — our Password Generator makes one instantly, with no reuse across your accounts.

How a password can be checked without being sent

Checking whether a password appears in a breach corpus seems to require sending it somewhere, which would be a poor trade. The technique that avoids this is k-anonymity, and it is worth understanding because it is genuinely clever.

The password is hashed with SHA-1 in your browser. Only the first five characters of that hash are sent to the breach service, which returns every hash in its corpus beginning with those five characters — typically several hundred. Your browser then searches that list locally for the full hash.

The service therefore learns a five-character prefix shared by many thousands of possible passwords, and never receives the password, the full hash, or any indication of which returned entry matched. The full password never leaves your device, and the answer is still exact.

What a breach result means

A password appearing in a breach corpus does not mean your account was compromised. It means that string has appeared in a breach somewhere, of any service, by any user. Common passwords appear millions of times because millions of people chose them.

That is still decisive, because of how attacks actually work. Credential stuffing takes username and password pairs from one breach and tries them against other services, exploiting reuse. Password spraying tries a handful of very common passwords against many accounts. Both draw on exactly these corpora, so any password appearing in one is effectively on a list attackers already hold — its strength as measured by length and character variety is irrelevant.

A result of zero is weaker evidence than it appears. It means the password is not in that corpus, not that it is strong or that it has never been exposed. Breaches go undetected for years, and many are never published.

What to do instead of checking

The durable fix is to stop having passwords you could check. A password manager generates a long random password per site, so reuse becomes impossible and a breach at one service tells an attacker nothing about any other. You remember one strong passphrase and the manager handles the rest.

Where you must remember a password, length beats complexity. Four or five random words are both easier to recall and harder to attack than a short string of substituted characters, because attackers know the substitution patterns — replacing a with @ adds essentially nothing against a modern cracking rule set.

Two-factor authentication is the single highest-value addition, and it changes the outcome even when a password is genuinely compromised. Prefer an authenticator app or a hardware key over SMS, which is vulnerable to SIM-swapping. Generate replacements with the password generator, and prioritise email first — control of an inbox allows password resets everywhere else.

Password breach checker FAQ

Is it safe to type my real password into this tool?

Yes. Your password is hashed with SHA-1 directly in your browser and never transmitted. Only the first 5 characters of that hash are sent to the Have I Been Pwned API (k-anonymity) — that tiny prefix matches hundreds of unrelated passwords, so it's mathematically impossible to reconstruct your actual password from it.

What does it mean if my password was found?

It means that exact password has appeared in at least one known data breach and is in criminals' password-cracking dictionaries. Stop using it anywhere, especially if you've reused it across sites.

What does it mean if it was NOT found?

It isn't in the known-breached password database — reassuring, but not a guarantee of strength. A short or predictable password can still be easy to guess even if it's never leaked.

Where does the breach data come from?

Have I Been Pwned's Pwned Passwords database, compiled from real-world breaches and totaling billions of exposed passwords — run by security researcher Troy Hunt, and used by major browsers and password managers for breach warnings.

Is my password sent anywhere when I check it?

No. It is hashed locally and only the first five characters of the hash are sent. The service returns all hashes sharing that prefix and the match is found in your browser, so the service never sees the password or the full hash.

My password was found — does that mean I was hacked?

Not necessarily. It means that string appears in a breach corpus, possibly from another service entirely. It is still on lists attackers use for credential stuffing, so change it wherever it is used.