Password Breach Checker

Check if your password has appeared in a known data breach — your password is never transmitted.

Ad
How this works safely (k-anonymity):
Your password is hashed with SHA-1 locally. Only the first 5 characters of the hash are sent to the HaveIBeenPwned API — never the full hash, never the password itself. The API returns all hashes that start with those 5 characters (hundreds of results). Your browser then checks locally whether your full hash appears in the list. This means the server never knows which password you're checking.
Ad

About Password Breach Checking

Data breaches happen constantly. When a website is compromised, attackers often dump a database of username/password combinations. Security researcher Troy Hunt maintains the HaveIBeenPwned database, which contains over 10 billion compromised passwords from thousands of breaches. If your password appears in this database, it means attackers already know it — even if they don't know which website you used it on.

This tool uses the Pwned Passwords k-anonymity API, which was specifically designed to allow checking without revealing your password. Only 5 characters of the SHA-1 hash are sent — the rest of the matching happens in your browser. This means neither this site nor the HaveIBeenPwned API ever sees your actual password or its full hash.

How to Use

  1. Type a password in the input field.
  2. Click 🛡️ Check Password to query the HaveIBeenPwned database.
  3. If the password has been seen in breaches, you'll see how many times — change it immediately.
  4. If it hasn't been seen, it's not in the database — but check password strength too.

Frequently Asked Questions

Correct. The k-anonymity model works like this: (1) Your browser computes the SHA-1 hash of your password. (2) Only the first 5 hex characters of that hash are sent to the API — for example 21BD1. (3) The API returns all hashes in its database that start with 21BD1 — typically 400–900 results. (4) Your browser searches that local list for your complete hash. The API only ever sees a 5-character prefix that could match hundreds of thousands of different passwords. You can verify this by inspecting the network request in your browser's DevTools.

Not necessarily — "not in the breach database" means it hasn't appeared in a known breach that was reported to HaveIBeenPwned. Your password could still be weak (easily guessable), used on a site that was breached but not reported, or compromised through phishing. Use the Password Strength Checker alongside this tool, and always use a unique password for each site.

No. Your password is hashed locally and only 5 characters of that hash are sent to the HaveIBeenPwned API. This site never receives, logs, or stores your password or its full hash. The HaveIBeenPwned API is HTTPS-encrypted and free to use.
🔒Password Strength CheckerTest your password's entropy and strength 🔑Password GeneratorGenerate cryptographically secure passwords 🔒Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 🔐JWT DecoderDecode and inspect JWT tokens 🔤Base64 EncoderEncode and decode Base64 strings 🎲Random Number GeneratorGenerate cryptographically random numbers
Ad