Has your password been leaked?

Check whether a password appears in the Have I Been Pwned database of passwords exposed in real data breaches. Your password is never sent anywhere: it is hashed in your browser and only the first 5 characters of the hash are used for the lookup.

How your privacy is protected: your browser computes the SHA-1 hash of the password and sends only its first 5 hex characters to api.pwnedpasswords.com. The service returns every leaked hash starting with those 5 characters (hundreds of them, plus random padding), and the match is made on your device.

How this breached password check works

Since 2017, the security researcher Troy Hunt has published Pwned Passwords, a collection of more than 900 million unique passwords recovered from real data breaches, used by organisations such as password managers and identity providers. Checking against it is the single most useful test you can run on a password: attackers start every guessing attack with exactly these lists, so a leaked password is weak no matter how long or complex it looks.

To check a password without revealing it, this page uses a technique called k-anonymity:

  1. Your browser computes the SHA-1 hash of the password, for example password becomes 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
  2. Only the first 5 characters (5BAA6) are sent to the API. About a million different passwords share any given prefix, so the prefix says nothing about yours.
  3. The API returns every leaked hash suffix that starts with that prefix, typically 800 to 1,000 lines, plus random padding so the response size doesn’t leak information.
  4. Your browser looks for the rest of your hash in that list. The result never leaves your device.

We explain the method, its limits, and why SHA-1 is fine here in our guide on how breached password checks work.

What to do if your password was found

  • Stop using it everywhere. Attackers run “credential stuffing”: they try leaked email and password pairs on hundreds of other sites automatically.
  • Change it on important accounts first: your email (it can reset everything else), then banking, shopping, and social accounts.
  • Use a unique random password for each account, stored in a password manager. Our password generator creates one in a click.
  • Turn on two-factor authentication so a leaked password alone is no longer enough to sign in.

Frequently asked questions

Is it safe to type my real password here?

The password itself is never transmitted, only 5 characters of its hash, and nothing is logged by this site. You can verify this in your browser’s developer tools (Network tab). If you prefer, check a password you are about to use rather than one protecting a sensitive account today.

My password was not found. Is it secure?

Not necessarily. “Not found” means it has not appeared in a known breach. A short or predictable password can still be cracked quickly. Use the crack time calculator to see how long it would resist.

Does this check my email address?

No. This tool checks passwords only. To see whether your email address appears in breaches, use the search on haveibeenpwned.com directly.

Why does a strong-looking password show up?

Because someone, somewhere, chose it too. Passwords like P@ssw0rd2024! satisfy most complexity rules and appear thousands of times in breach data. Only randomly generated passwords avoid this.

Learn more