Password
Breach Check.
Find out whether a password has turned up in a known data breach — without sending it anywhere. Your browser hashes it locally and asks only about a bucket of roughly a million possible hashes.
Corrections welcome — see our editorial policy.
Your password never leaves this page. Only the first 5 characters of its SHA-1 hash are sent, and they go straight to Have I Been Pwned — not to us. Open your browser's network panel and watch if you like; that is the point of doing it this way.
See what else leaks about you.
Check your browser fingerprint →Read this before you type anything
The honest advice, first: the best password to check here is one you are about to stop using. If your password manager offers a built-in breach check, use that instead — it does the same thing without a web page in the middle. And if you already suspect a password is compromised, you do not need this tool to confirm it. Just change it.
That said, the method below is genuinely sound, and it is worth understanding why rather than taking anyone's word for it.
How your password stays private
This uses a technique called k-anonymity, and the arithmetic is the whole safety argument.
Your browser computes the SHA-1 hash of what you typed — a 40-character hexadecimal string. It then sends the first five characters and nothing else. Five hex characters describe one of 165 buckets, which is 1,048,576 of them. Have I Been Pwned answers with every breached hash that starts with those five characters, typically between 800 and 2,000 of them, and your browser looks for yours in that list.
So the service learns that someone asked about a bucket containing roughly a thousand known-breached passwords, plus however many unbreached ones share the prefix. It does not learn which one you meant, and it never sees the remaining 35 characters of your hash — let alone the password itself.
The request also asks for padding. Without it, the number of results could hint at which bucket was requested; with it, responses are stuffed with dummy entries so every reply looks much the same size. Those dummies carry a count of zero and are discarded before matching, which is exact rather than approximate: a password that had genuinely appeared in a breach could never have a count of zero.
Who sees what
We see nothing. The request goes from your browser directly to Have I Been Pwned. It does not pass through our servers, we do not proxy it, and this page sends no analytics about what you type — not the password, not the result, not even whether one was found. You can verify all of that in your browser's network panel, which is a stronger guarantee than anything we could write here.
Have I Been Pwned sees your IP address and five hexadecimal characters. That is the cost of asking them directly rather than through us, and it is the right trade: routing it through our servers would hide your address from them while showing the prefix to us, and we would rather not be in the path at all.
One practical consequence of that choice: some ad blockers and corporate proxies block third-party requests, and if yours does, the check will simply fail rather than fall back to sending anything through us.
What "not found" does and does not mean
This is the part most tools get wrong, so it is worth being blunt: a password that is not in the corpus has not been shown to be safe. It has been shown to be absent from a specific, large, but finite collection of breaches that have been gathered and published.
A password can be absent from that collection and still be terrible. Tr0ub4dor&3 is not in it. Neither is your street name with a birth year, or any of the millions of predictable passwords nobody has happened to leak yet. Absence tells you that a credential-stuffing attacker working from published dumps does not already have this exact string. It tells you nothing about whether someone guessing at your account would arrive at it.
Plenty of breaches are also never published. Some are never detected. Some are sold privately and never surface. The corpus is a floor, not a ceiling.
So a "not found" here is not a green light, and this page deliberately does not show one. What actually makes a password strong is length and uniqueness — a long passphrase used in exactly one place, generated by something that is not you.
What "found" definitely means
A hit is unambiguous, and it is the reason to run this at all. If your password appears in the corpus, it is in the wordlists that attackers feed into credential-stuffing tools, and those run continuously against every login form on the internet.
The count matters more than the yes or no. A password seen a handful of times might be an unlucky coincidence — someone else chose the same odd string. A password seen tens of millions of times is one of the most common on earth and will be tried within the first few thousand attempts against any account.
Either way the response is the same. Change it wherever it is in use, and if it is used in more than one place, that reuse is the more urgent problem — a single breached password becomes a key to every account sharing it.
Why SHA-1, given SHA-1 is broken
A fair question. SHA-1 is broken for collision resistance, which is why it has no business signing certificates or verifying downloads.
None of that applies here. Nothing is being authenticated and no attacker is being asked to not find a collision. The hash is a lookup key into a published corpus, and the corpus is keyed on SHA-1 because that is what it was built with. The security property that matters — the service not learning your password — comes from sending five characters instead of forty, not from the strength of the hash.
Common questions
Is it really safe to type my real password here? The method is sound and the password does not leave your browser. But the safest habit is still to check a password you are retiring, or to use your password manager's built-in check. A tool that asks you to type a live password into a web form should tell you that, and this one is telling you.
Where does the data come from? Have I Been Pwned's Pwned Passwords corpus, assembled from published breach dumps. It is free to query, needs no account, and its operator explicitly places no licensing or attribution requirement on this particular endpoint — we credit it because it is worth crediting.
My password was found. What do I do first? Change it on the account that would hurt most if it were lost — usually your email, because email resets everything else. Then work through anywhere else the same password is used. Then turn on two-factor authentication where it is offered, which is what limits the damage when a password does leak.
Can this tell me if my account was breached? No. It answers a question about a password string, not about you. A password can appear in the corpus because someone unrelated used the same one.
Nothing happens when I click Check. The request goes to a third party, so an ad blocker, a privacy extension or a corporate proxy can stop it. There is no fallback by design — a fallback would mean routing your prefix through us, which is exactly what this page promises not to do.
If you are auditing your own exposure more broadly, the browser fingerprint and DNS leak checks cover what leaks without you typing anything at all.