Check whether your password has leaked in any public data breach. We query HaveIBeenPwned - an aggregate of 800+ breaches containing 850M+ unique passwords. Your full password never leaves the browser: we SHA-1 it locally, send only the first 5 hex characters to the API (k-anonymity), and match the rest in your tab.
How to check a password
- Type the password in the field. It is hidden by default - click the eye icon to reveal.
- Click "Check" or press Enter.
- Wait 1-2 seconds. The result appears as green (safe) or red (found in breaches, with the count).
- If pwned - change it immediately on every account that uses it. Generate a new, never-leaked replacement in our password generator, then run the password strength estimator to confirm it survives common attacks.
Use cases
Verify whether a password you've used for years sits in a public breach. Audit company passwords before tightening policy. Verify a password generated elsewhere. Check whether an old password from your manager is still safe or compromised long ago.
Frequently asked questions
Yes. SHA-1 hashing happens locally via the Web Crypto API (crypto.subtle.digest). We send only the first 5 hex chars of the digest to the HaveIBeenPwned API. The API returns ~800 hashes starting with that prefix and the match against your hash happens locally. Open DevTools Network - you'll see only a /range/A1B2C request where A1B2C is the public prefix.