Password Leak Check
Breach check

Has your password been leaked?

Check a password against hundreds of millions of passwords exposed in real data breaches. Your password never leaves this page: only a 5-character piece of its hash is sent.

  • Your password is hashed on your device and never sent.
  • Uses the Pwned Passwords breach list (k-anonymity).
  • No account, no logging, no analytics.

Your browser turns the password into a SHA-1 hash and sends only its first 5 characters. The database replies with every leaked hash starting the same way, and the match is made here.

How it works

This check uses a method called k-anonymity, so the breach database never learns your password or even its full hash.

  1. Hash it here

    Your browser turns the password into a 40-character SHA-1 hash. The password itself never leaves the page.

  2. Send 5 characters

    Only the first 5 characters of the hash go to the Pwned Passwords service, which replies with hundreds of leaked hashes that start the same way.

  3. Match it locally

    Your browser looks for the rest of your hash in that list and tells you how many times it has been seen in breaches.

Why use this one

Small, fast and private: one page that does one job well.

Password never sent

Only 5 hex characters of a hash are shared, which match hundreds of different passwords.

Huge breach list

Pwned Passwords holds hundreds of millions of real passwords from public data breaches.

Padded replies

Requests ask for padded responses, so even the size of the reply doesn't hint at your password.

Strength hint

If a password isn't in any breach but is short or follows a common pattern, you're told so.

No tracking

The site has no analytics, no cookies and no server code. Requests carry no referrer.

Open method

The same method password managers and browsers use for their breach alerts.

Frequently asked questions

Is it safe to type my real password here?

Yes. The password is hashed with SHA-1 by your own browser and only the first 5 characters of that hash are sent. Those 5 characters are shared by hundreds of different passwords, so the service can't tell which one you checked. Nothing is stored or logged by this site.

What does it mean if my password is found?

It has appeared in at least one public data breach, so attackers include it in the lists they try first. Stop using it on every site, and replace it with a new, unique password.

My password wasn't found. Is it safe?

It isn't in known breach lists, which is good, but that alone doesn't make it strong. Use a long, random password or passphrase, keep it to one site, and turn on two-factor login.

Where does the breach data come from?

From Pwned Passwords, a free service by Have I Been Pwned that collects passwords from public data breaches. The data is licensed under Creative Commons Attribution 4.0.

Does it check my email address?

No. This tool checks passwords only. Checking an email address would mean sending it to a server, which this site avoids.

More free tools

Each one runs in your browser with no sign-up and no tracking.