Password Breach Checker — Has Your Password Been Leaked?

Has your password been leaked? Check it against the Have I Been Pwned database with k-anonymity — only the first 5 characters of its hash ever leave your device, so your password stays private. Plus what to do next if it’s breached.

Password Breach Checker — Has Your Password Been Leaked?

Password Breach Checker — Has Your Password Been Leaked?

Find out in seconds whether your password has appeared in a known data breach. Your password is hashed on your device and never sent anywhere — only 5 anonymous characters ever leave your browser.

Want a safe test? Try a famously-breached sample
How your privacy is protected (k-anonymity): your password is hashed with SHA-1 on this device. Only the first 5 characters of that hash are sent to the api.pwnedpasswords.com database, which returns every matching hash fragment — the full comparison happens right here in your browser. The password itself is never transmitted, logged, or stored anywhere.
DoCheck passwords you personally use, then change any that show up in a breach.
Do notEnter someone else’s password. Check only your own credentials — responsible use only.
100% private

Your password never leaves this device — only 5 anonymous hash characters are sent.

No signup

No account, no email, no tracking. Type, check, done.

Free forever

Unlimited checks against the Have I Been Pwned breach database, at no cost.

How to use it

  1. 1
    Type your password

    Enter the password you want to check in the box above. Use the Show button to double-check your typing.

  2. 2
    Hit “Check for Breaches”

    Your password is hashed locally and only the first 5 hash characters are sent to the breach database.

  3. 3
    Read the verdict

    “Found” means attackers have it — change it now. “Not found” means it has never appeared in a known breach.

What to do if your password was found

1. Change it everywhere

Replace it on every account that uses it — starting with email and banking, since those unlock everything else.

2. Go unique per site

Never reuse one password across sites. One breached password should never unlock your other accounts.

3. Turn on 2-factor auth

Add two-factor authentication to your important accounts so a stolen password alone is not enough to get in.

4. Generate a new one

Use our free Password Generator to create a long, random replacement in one click.

Why this check is safe

K-anonymity design

Instead of sending your password or its full hash, the tool sends only the first 5 characters of its SHA-1 hash — a fragment shared with millions of other passwords.

Local comparison

The database returns roughly 800 hash fragments matching that prefix, and the exact match is found on your device. Your password is never reconstructed server-side.

Nothing stored

The password field is cleared after every check. This page keeps no logs, cookies, or history of what you typed.

Official breach data

Checks against the Have I Been Pwned password database — hundreds of millions of real-world breached passwords, via their recommended API.

Works on any device

Uses your browser’s built-in encryption tools. Works on phones, tablets, and desktops with no app to install.

Instant verdict

The database responds in under a second, so you get a clear “found” or “not found” answer immediately.

Frequently asked questions

What is k-anonymity, in plain English?
It means your password can never be identified from what is sent. Your password is hashed into 40 characters (SHA-1), and only the first 5 go over the internet. Those 5 characters match about 800 different password hashes in the database, which are all sent back to your browser — the exact comparison happens on your device, so the service never learns which password you checked.
Is it safe to type my real password into this page?
Yes, by design: the password is hashed locally and never transmitted or stored, and the field is cleared after each check. As a rule of thumb, only check passwords on devices and networks you trust, and never paste a password into any site you do not recognize.
My password was found in a breach — what should I do now?
Change it immediately on every site where you used it, starting with your email and bank accounts. Use a long, unique password for each site (our Password Generator makes this easy), and turn on two-factor authentication on your most important accounts.
What does “not found” mean?
It means your exact password has not appeared in the breaches in the Have I Been Pwned database. That is a good sign, but it does not guarantee the password is strong — pair this check with our Password Strength Checker to make sure it is also hard to guess.
Can I check a password without an internet connection?
No — the breach database lives online, so the check needs a connection. If the database cannot be reached, the tool tells you so and sends nothing. The hashing step itself always runs on your device.
What is Have I Been Pwned?
A free breach-notification service created by security researcher Troy Hunt. It aggregates passwords exposed in real data breaches (hundreds of millions of them) and offers this k-anonymity API so anyone can check a password without revealing it.
Can I check someone else’s password?
Please do not. This tool is for checking your own credentials only. Entering another person’s password without permission is not a responsible use of the tool.

Related tools

Password Generator

Create long, random, hard-to-crack passwords in one click.

 Password Strength Checker

Test how resistant your password is to guessing attacks.

 Username Generator

Generate unique usernames for new accounts and profiles.

 Random Number Generator

Pick truly random numbers for draws, games, and giveaways.
Scroll to Top