All tools

Tools

Password Breach Checker

Check whether a password has appeared in a known data breach. Your password is hashed in your browser and never sent - only the first 5 characters of its hash leave your device (k-anonymity, via HaveIBeenPwned).

Tip: don't paste a password you actively use - test variations instead.

How it stays private

Your browser computes SHA-1(password), then sends only the first 5 hex characters to my API, which relays them to HaveIBeenPwned. That prefix matches hundreds of hashes, so no one - not HIBP, not my server - can tell which password you checked. The final match happens locally in your browser.