Password Breach Checker

How to Use

1. Type or paste the password you want to check.
2. Optionally click "Show" to verify what you typed.
3. Click "Check for breaches".
4. A green result means it wasn't found in the breach database; a red result shows how many times it has appeared.

Example

Input

password123

Output

⚠ Found in 2,643,916 known data breaches

Common passwords like this appear millions of times because they're on every attacker's first-guess list, regardless of which site was breached.

What Is This Tool?

This tool checks a password against Have I Been Pwned's Pwned Passwords database, which contains hundreds of millions of passwords collected from real data breaches. If your password shows up, it means it's already in attackers' password lists — not because your specific account was breached, but because someone, somewhere, used that same password and it leaked.

The check uses a technique called k-anonymity, designed specifically so a password checker never needs to see the full password. Your browser computes the SHA-1 hash of the password locally, then sends only the first 5 characters of that hash to the API. The API returns every breached password hash that starts with those same 5 characters — usually several hundred — and your browser checks locally whether your full hash is among them. The full password and full hash never leave your device.

How k-anonymity protects your password here

A naive breach checker would need your full password (or its full hash) to look it up — which means trusting a server with exactly the secret you're trying to protect. The k-anonymity approach sidesteps that: your browser hashes the password with SHA-1, then sends only the first 5 hex characters of that 40-character hash to the API.

The API responds with every hash suffix in its database that shares that 5-character prefix — typically 300–800 of them, not just yours. Your browser then checks locally whether your specific suffix is among them. An eavesdropper watching the network request learns only that some password with that prefix was checked, out of millions of possibilities — nowhere near enough to know which one.

What to do with the result

• Found with a high count: retire this password everywhere immediately — it's on every attacker's guess list.
• Found with a low count: still retire it. Even one prior breach means it's compromised, regardless of the number.
• Not found: this exact string isn't in the database, but check its strength separately before trusting it long-term.
• Checking a password you're about to set is just as useful as checking one you already use — catch a bad choice before it becomes your account's weak point.

→ Password Generator · MD5 Generator

Common use cases

• Checking an existing password you've used for years and never verified against breach data.
• Verifying a newly generated or newly chosen password before committing to it.
• Auditing a shared or default password used across a team or family before rotating it.
• Deciding which of several reused passwords to prioritize changing first, based on breach count.

Why Use It?

K-anonymity model: only 5 hash characters are transmitted, never the password or its full hash.

Checks against a real database of hundreds of millions of breached passwords, updated continuously.

Instant result — no account, no email required, nothing stored.

Works for any password: one you're currently using, one you're about to set, or an old one you're wondering about.

Frequently Asked Questions