Free Tools/Breached Password Checker
Has this password already leaked?
Billions of passwords have been exposed in data breaches, and attackers try them against business accounts every day. Check any password against the Have I Been Pwned breach database without it ever leaving your browser.
Your password is scrambled on your device; only the first 5 characters of the scramble are ever sent, which is not enough to identify it. We never see or store it.
How can this be private?
- 1
Your browser scrambles the password using a one-way function (SHA-1 hashing) before anything happens. The real password never goes anywhere.
- 2
Only the first 5 characters of the scramble are sent to the Have I Been Pwned database. Thousands of different passwords share those same 5 characters, so the request reveals nothing about yours.
- 3
The database sends back every breached match for that prefix and your browser checks the full scramble locally. The comparison happens on your device, not on a server.
This approach (called k-anonymity) is the same one built into Google Chrome's password checkup and used by major password managers. It's the industry-standard way to check breach exposure without creating new risk.
Common questions
Is it really safe to type a password in here?
Yes, and here's exactly why. Your password is scrambled (hashed) on your own device. Only the first 5 characters of that scramble are sent to the Have I Been Pwned database, which returns every breached scramble starting with those characters (hundreds of them). Your browser then checks for a match locally. Neither we nor the database ever see your password, or even enough of the scramble to identify it. This "k-anonymity" method is trusted by browsers like Chrome and services like 1Password.
My password was found in breaches. What now?
Stop using it everywhere, today. Attackers take breached password lists and try them against email, banking, and business accounts automatically (called "credential stuffing"). Change it on every account that uses it, starting with email, and switch to unique passwords per account with a password manager. Turn on multi-factor authentication wherever you can.
My password was NOT found. Does that mean it's safe?
It means it hasn't shown up in known public breaches, which is good news, but it says nothing about strength. A short or guessable password can still be cracked directly. Check it in our password strength tester too, and never reuse it across accounts.
What is Have I Been Pwned?
A widely respected free service run by security researcher Troy Hunt. It collects passwords exposed in real data breaches (over 900 million of them) so people and companies can check exposure safely. Many banks, governments, and password managers use it behind the scenes.
Worried about breached accounts across your business?
One reused password is often how a whole company gets breached. We monitor for exposed credentials, roll out password managers and multi-factor authentication, and train your team. The first conversation is free.