tools / Passwords & Privacy
Pwned Password Check
Check whether a password has turned up in known data breaches. It uses k-anonymity, so your password never leaves your browser: only the first five characters of its SHA-1 hash are sent, and the matching happens locally.
Checks the password against the Have I Been Pwned breach corpus. Your password never leaves your machine, only a short hash prefix does.
How it works
How k-anonymity protects you
The password is hashed with SHA-1 in your browser. Only the first five hex characters of that hash go to the Have I Been Pwned range API, which returns every hash suffix that shares that prefix. Your machine finds the match, so the service never sees your password or its full hash.
FAQ
Is it safe to type my real password here?
The design is built so a real password is safe to check: it is hashed locally and only a five-character prefix is sent. If you are still uneasy, change the password first, then check the old one.
It says not found, am I safe?
It means the password has not appeared in the breach corpus, not that it is strong. A unique but weak password can still be guessed, so check its entropy too.
