How the check works without sending your password
This tool uses a privacy technique called k-anonymity, built on the Pwned Passwords database by Troy Hunt (Have I Been Pwned):
- Your browser turns the password into a SHA-1 hash, for example
5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. - Only the first 5 characters (
5BAA6) are sent. Hundreds of different leaked passwords share those 5 characters. - The database returns all of them, plus random padding so the answer size reveals nothing either.
- Your browser compares the rest of the hash locally. Neither we nor the database ever learn which password you checked.
Below the tool you can see the exact 5 characters that were sent for your check.
My password was found. What now?
- Change it now on every site where you use it, starting with email, banking and your password manager.
- Never reuse it. Leaked passwords are used in credential stuffing: bots try them on thousands of other sites automatically.
- Use a unique, random password per site, stored in a password manager. Our password generator makes one in one click.
- Turn on two-factor authentication so a password alone is not enough to log in.
A password that was found once is just as unsafe as one found a million times. Attackers' lists include every password ever leaked.
Not found. Am I safe?
It means this exact password is not in any public breach collection. It does not mean it is strong. A short password or a name plus a year can be guessed quickly even if it never leaked. The strength line under a clean result shows how long it would take to crack.
Frequently asked questions
Is it safe to type my real password here?
Yes. The password is hashed in your browser and only the first 5 of 40 hash characters are sent to the Pwned Passwords API. We run no server code for this page, store nothing and use no analytics.
Where does the breach data come from?
From Pwned Passwords, the free database run by Troy Hunt's Have I Been Pwned, with more than 900 million real passwords from public data breaches, also used by password managers and governments.
Can I check my email address too?
Email breach lookups need a paid API key and send your email address to a third party, so this tool focuses on passwords. You can check an email directly at haveibeenpwned.com.
Can I check many passwords at once?
Yes. Choose 'Many at once' and paste up to 50 passwords, one per line. Each is checked with the same 5 character method, and the results table masks every password.
Why is my strong-looking password leaked?
Because someone, somewhere, used the same string and their account was breached. Attackers do not care who used it first. If it is in the list, it is in their dictionary.