Password Breach Checker
Check if a password appears in known breaches (k-anonymity, private)
Has this password leaked?
Checks a password against Have I Been Pwned's database of billions of leaked passwords — using k-anonymity, so your password never leaves your device in full. It's SHA-1 hashed locally and only the first 5 characters of the hash are sent; the service returns matches for that prefix and the match is confirmed in your browser.
FAQ
Is it safe to type my password here?
Your password is hashed locally and only a 5-character hash prefix is sent to the API. The server never sees your password or its full hash. Still, avoid checking a password you're actively using elsewhere if you're cautious — check variations instead.
What does the count mean?
It's how many times that password has appeared in known data breaches. Any non-zero count means it's known to attackers and should not be used.
Not found — am I safe?
It means the password isn't in this dataset, not that it's strong. Length and uniqueness still matter — pair this with the Password Generator.