Result will appear here
Tips for breach checks
A hit means change that password everywhere it was reused.
No hit does not mean the password is strong — only “not seen yet”.
Prefer checking hashes via k-anonymity; avoid sending full passwords to random sites.
After a breach hit, enable 2FA on the affected accounts.
Treat results as one signal alongside length and uniqueness.
Check a password against known leaks
Only a 5-character SHA-1 prefix is sent to api.pwnedpasswords.com. The password itself stays in the browser.
This uses the Have I Been Pwned range API: the password is hashed locally with SHA-1, and only the first five hex characters are sent. The full password never leaves the device.
A match means that exact secret appeared in a public dump. Change it everywhere it was reused — the check does not log you into anything.
Check for a known leak
Type the password to test
Prefer a candidate you are about to retire, not a password you must keep using on a shared screen.
Run the k-anonymity lookup
The API returns many hash suffixes; the browser matches yours locally.
Act on a hit
If it appears in dumps, stop using it and generate a new unique password.
Pwned password FAQ
Do you send my password to a server?
No. Only a 5-character SHA-1 prefix goes to api.pwnedpasswords.com. The password itself stays in the browser.
A hit means someone is in my account?
It means the password was in a breach corpus — not that this page accessed your account.
No hit means it is safe forever?
No. New dumps appear later, and phishing does not need a dump.