Loading
Loading
Free online tool
Check whether a password appears in known breach data without sending the password or its full hash.
Privacy-preserving lookup
Your password stays in this browser. It is hashed locally. Only the first five characters of that hash are shared with Have I Been Pwned, and the final comparison happens here.
Enter a password and select Check password to begin.
Privacy: The password and full hash never leave your browser. Only a five-character hash prefix is sent directly to HIBP; this page loads no advertising or third-party analytics scripts.
A password breach checker lets you verify whether a specific password has been exposed in known data breaches — without revealing the password itself to any third party. This tool queries the Have I Been Pwned (HIBP) Pwned Passwords database, which contains over 900 million compromised passwords collected from real-world breaches. The check is performed using a privacy-preserving k-anonymity protocol: your browser hashes the password locally and sends only the first five characters of the hash to HIBP. The full hash never leaves your device, and neither does the plaintext password.
When you enter a password and click Check, the tool performs these steps entirely in your browser: first, it converts the password into a SHA-1 hash using the Web Crypto API. Then it takes only the first five characters of the 40-character hash and sends them to the HIBP Pwned Passwords range endpoint. HIBP returns a list of all hash suffixes (the remaining 35 characters) that share the same prefix, along with their occurrence counts. Your browser then searches this list locally for a match. This k-anonymity approach ensures that HIBP never learns your full hash — and therefore can never reconstruct or identify your password.
You want to check whether the password 'P@ssw0rd123' has been exposed in any known data breach.
You have confirmed that 'P@ssw0rd123' is severely compromised and should be changed immediately on every account that uses it.
No. Your browser converts it to a SHA-1 lookup hash locally. Only the first five hash characters are sent directly to Have I Been Pwned; the full comparison happens in your browser.
The Pwned Passwords corpus is indexed by SHA-1, so this checker uses it only as a lookup key. SHA-1 is not suitable for storing passwords; services should use a dedicated, salted password-hashing algorithm.
No. It only means the password was not present in the corpus at the time of this check. It could still be weak, reused, newly exposed, or known to an attacker.
It is the number of times that password appears in the current HIBP Pwned Passwords data. It is not a count of your accounts or proof of which breach contained it.
Change it everywhere you used it, give every account a unique password, use a reputable password manager, and enable multi-factor authentication where available.
The checker shows that no result was produced. It does not silently use another provider. You can retry later; the result always depends on HIBP availability and its current corpus.
Checking your passwords against known breach data is one of the simplest and most effective security measures you can take. This free Password Breach Checker performs the lookup privately using k-anonymity — your full password hash never leaves your browser. If a password is found, change it immediately and replace it with a unique, randomly generated credential. Combine regular breach checks with a password manager and multi-factor authentication for comprehensive account protection.