Password Breach Check

Checks the Have I Been Pwned database of 900+ million leaked passwords. Your password is SHA-1 hashed in your browser - Only the first 5 hash characters are ever sent, so the full password never leaves your device.

Powered by the Have I Been Pwned k-anonymity range API. We never see your password; neither do they.

How the Check Stays Private

k-anonymity, step by step

  1. Your browser computes the SHA-1 hash of the password locally.
  2. Only the first 5 characters of that hash are sent to the API.
  3. The API returns every leaked hash starting with those 5 characters (usually 700–1,000 of them).
  4. Your browser checks the list for the full hash - the match happens on your device.

The server can never know which password - Or even which full hash - You were curious about. The same design protects queries in Chrome's and 1Password's built-in breach checks.

Found in a breach? Do this

How to Use the Password Breach Check

1

Type the password

It's hashed with SHA-1 locally before anything touches the network.

2

Run the check

Only the first 5 hash characters go to the Have I Been Pwned API - A k-anonymity query.

3

Read the verdict

A hit shows how many times the password appears in real breach dumps.

4

Replace and protect

If it's breached: generate a new password, update every account using it, and enable 2FA.

What a breach count actually means

ResultMeaningWhat to do
0 matchesNot in any known public breach corpusGood sign - But still verify strength; new breaches surface constantly
1–100 matchesLeaked, in cracking dictionariesReplace everywhere, enable 2FA
100–100K matchesA commonly chosen passwordNever use it or variations of it
100K+ matchesAmong the most-used passwords on EarthAttackers try these first - Instant compromise risk

Password Breach Check - FAQ

Is it safe to type a real password here?
Yes - The design guarantees the password never leaves your browser. It's hashed locally, only a 5-character hash prefix is transmitted, and the matching happens on your device. This is the same k-anonymity model Chrome and 1Password use for their breach checks.
My password wasn't found. Does that mean it's safe?
It means it hasn't appeared in Have I Been Pwned's corpus of publicly known breaches. It could still be weak, guessable, or exposed in an unpublished breach. Check its strength separately, and never reuse it across sites.
Where does the breach data come from?
Have I Been Pwned aggregates passwords recovered from real, public data breaches - Over 900 million unique passwords from incidents like RockYou, LinkedIn and Collection #1. It's run by security researcher Troy Hunt and used by governments and browsers worldwide.
Why does the count matter?
Cracking tools try passwords in order of popularity. A password seen 3 million times will be guessed in the first second of an attack; one seen twice sits deep in the list. Either way, once it's in a dictionary, it's burned.

More questions about passwords and security? Browse the security guides.

More Free Tools

Password Generator →

Password Strength Checker

Entropy, crack-time estimates and pattern warnings - All offline.

2FA Code Generator

Generate TOTP secrets, QR codes and live 6-digit codes.

Password Generator

Random passwords with full control over length and characters.

Passphrase Generator

Memorable multi-word passphrases (Diceware style).

PIN Generator

Random 4–12 digit PIN codes with no weak patterns.

Username Generator

Random, non-identifying usernames for new accounts.