Password Leak Checker
Check if a password has appeared in known data breaches. Uses the HaveIBeenPwned k-Anonymity API, so your password is never transmitted; only a partial hash prefix is sent.
This tool uses the k-Anonymity model: your password is hashed locally using SHA-1 (SubtleCrypto), then only the first 5 hex characters of that hash (1 in 1 million possible values) are sent to the HaveIBeenPwned API. The full hash and the original password are never transmitted.
Press "Check for Leaks" to query the breach database. Strength is shown in real time as you type.
How the k-Anonymity Privacy Model Works
This is not just a claim. Here is the exact process, step by step.
SHA-1 Hash in Your Browser
When you click "Check for Leaks", the browser's SubtleCrypto.digest('SHA-1', ...) API converts your password into a 40-character hex hash. This happens entirely in your browser's JavaScript engine. Example: password → 5BAA61E4...
Only the First 5 Characters Are Sent
The browser sends a GET request to api.pwnedpasswords.com/range/{first5}, for example /range/5BAA6. The remaining 35 characters (which identify your specific password) never leave your device.
API Returns All Matching Suffixes
The HIBP API returns a list of ~500-1,000 hash suffixes that share the same 5-character prefix, plus the breach count for each. The server has no idea which of the ~1 million possible passwords with that prefix you care about.
Browser Checks Locally
Your browser compares the remaining 35 characters of your hash against the returned list. If your suffix is found, the count is displayed. If not, the password has not appeared in any indexed breach. All matching is done locally, so the server never learns the result.
What to Do If Your Password Is Found in a Breach
Change It Immediately
Change the password on every account where it is used. Even if you haven't noticed any suspicious activity, breached passwords should be considered fully compromised.
Generate a New Unique Password
Use our password generator to create a new, randomly generated password for each account. Never reuse passwords across accounts.
Enable Two-Factor Authentication
Enable 2FA on every account that supports it. 2FA means a leaked password alone is not enough for an attacker to log in; they also need access to your second factor.
Use a Password Manager
A password manager allows you to generate and store unique, strong passwords for every account without needing to memorise them. Reusing passwords is the primary risk factor after a breach.
Frequently Asked Questions
Yes. Your password is never transmitted. The k-Anonymity model guarantees this: only the first 5 of 40 hex characters of your password's SHA-1 hash are sent. The API server cannot determine your password from this prefix. The check against the returned list happens locally in your browser.
You can verify this yourself: open DevTools → Network tab and watch the requests made when you click "Check for Leaks". You'll see only a request to api.pwnedpasswords.com/range/XXXXX with 5 hex characters.
It means that exact password string has appeared in at least one publicly disclosed data breach indexed by HaveIBeenPwned. Attackers use these exact password lists in credential stuffing and dictionary attacks. Change the password immediately on every account where you use it and generate a new unique password for each.
"Not found" means the password does not appear in any breach currently indexed by HIBP (10 billion+ passwords). It does not mean: (1) the password has never been compromised in an unindexed breach, (2) the password is strong (it could be easily guessable), or (3) it is safe to reuse across multiple sites. Check strength separately using our Password Strength Checker.
HaveIBeenPwned (HIBP) is a free service created by security researcher Troy Hunt that aggregates data from publicly disclosed data breaches. Its Pwned Passwords database contains over 10 billion unique passwords collected from real-world breaches, making it the most comprehensive freely accessible breach password database available.
SHA-1 is a one-way cryptographic hash function that converts any input into a fixed 40-character hex string. "One-way" means the original password cannot be recovered from the hash. It is used here because the HIBP Pwned Passwords database is indexed by SHA-1 hashes. SHA-1 is considered cryptographically weak for digital signatures (collision attacks exist), but for this specific use case (a one-way hash of a user-provided string for k-Anonymity lookup), it is entirely appropriate.
Related Tools
Password Generator
Generate a new unique password to replace a compromised one.
Generate →Password Strength Checker
Check the strength of your replacement password.
Check →Crack Time Calculator
Estimate how long a password would take to crack.
Estimate →Passphrase Generator
Generate a memorable passphrase for accounts you must recall.
Try it →