Password Leak Checker
Find out whether a password has appeared in a data breach – without revealing it. Your browser computes the SHA-1 hash of the password and sends only the first five of its forty hex characters to the Pwned Passwords service by Have I Been Pwned. The service returns every known hash that starts with those five characters, and your browser compares them locally. The password and its full hash never leave the page, and nothing is logged or stored.
- Encrypted connection
- No sign-up
- Free to use
How to use Password Leak Checker
- Type or paste a password.
- Click Check password.
- See whether it appears in breaches and how often.
- Change any password that was found.
Password Leak Checker features
k-anonymity
Only a 5-character hash prefix is sent.
Local comparison
Matching happens in your browser.
Breach count
How often the password was seen.
Padding
Response size reveals nothing.
Strength hints
Length and common patterns.
No key needed
Free Pwned Passwords API.
When to use Password Leak Checker
- Checking passwords before you use them.
- Security awareness training.
- Auditing a password policy.
- Helping family members stay safe.
Password Leak Checker FAQ
Is it safe to type my password here?
Yes: the password is hashed in your browser and only the first five hex characters of the hash are sent. Millions of passwords share each prefix, so the service cannot know which one you checked.
What does “not found” mean?
The password is not in the Pwned Passwords collection. It can still be weak or guessable – use long, unique passwords.
Where does the data come from?
From Have I Been Pwned by Troy Hunt, which collects passwords from public data breaches (CC BY 4.0).
Should I change a found password?
Yes, everywhere you used it. Attackers try breached passwords first.
Is it safe to type my real password here?
Only the first five characters of its SHA-1 hash are sent, which cannot identify the password. Even so, you can test a password you are about to retire.
What should I do if my password was found?
Change it on every site where you used it, choose a unique password for each site and turn on two-factor authentication.
What is a strong password today?
A long, unique password – ideally generated by a password manager – or a passphrase of several random words. Length matters more than symbols.
Why breached passwords are dangerous
Attackers use lists of breached passwords in “credential stuffing” attacks against other sites. A password that appears even once is no longer safe to use.
The check uses k-anonymity: your browser hashes the password with SHA-1 and sends only the first five characters of the hash to Have I Been Pwned. The service returns all leaked hashes starting with those characters, and your browser looks for a match locally. The password itself, and its full hash, never leave your device.
A match means the password appeared in a known data breach and is likely in attackers’ word lists – stop using it everywhere, even if it looked strong. No match does not prove a password is safe; it only means it is not in that collection.
Use a password manager to create a unique password for every site, and turn on two-factor authentication for important accounts.