Free tool · CHECK
Has My Password Been Leaked?
Check a password against hundreds of millions of breached passwords without revealing it. Only 5 characters of its hash leave your browser.
The one tool that uses the network: only the first 5 characters of the password's SHA-1 hash are sent. The password itself never leaves your browser.
This is the one tool that uses the network. Your browser hashes the password with SHA-1 and sends only the first 5 hex characters to our server, which passes them to the Have I Been Pwned range API. Hundreds of unrelated hashes come back and the match happens on your device, so neither we nor HIBP learn your password or its full hash.
How it works
This checker tells you whether a password appears in known data breaches, using the Pwned Passwords service from Have I Been Pwned, without sending the password. If it shows up, attackers already have it in their wordlists and will try it against your accounts.
Exactly what happens
- Your browser computes the SHA-1 hash of the password, for example
5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. - It sends only the first 5 characters (5BAA6) to our server, which forwards them to the HIBP range API.
- HIBP returns every breached hash beginning with 5BAA6, plus padding rows, typically 800 to 1,000 lines.
- Your browser compares the remaining 35 characters with that list and shows how many times it was seen.
We do not log the prefix, and even if we did, it maps to hundreds of leaked passwords and millions of possible ones. The result is computed on your device and not reported anywhere.
SHA-1 is used here only as an identifier for lookups, because that is the format of the HIBP dataset. It is not protecting the password: k-anonymity is.
Read more: Storing passwords in a notes app.
Questions
Yes, with this method. Your password is hashed with SHA-1 in your browser and only the first 5 of the 40 hash characters are sent. The service returns every leaked hash that starts with those 5 characters, hundreds of them, and your browser looks for a match locally. Nobody on the other end can tell which password you checked.
It means your request looks the same as many others. Each 5-character prefix is shared by hundreds of leaked hashes and by countless possible passwords, so the prefix alone reveals almost nothing. Responses are also padded with fake entries so their size gives nothing away.
Only the 5-character hash prefix, for example 5BAA6. It goes to our server, which forwards it to the Have I Been Pwned Pwned Passwords range API, so HIBP sees our server and not your IP address. The password, the full hash and the result never leave your browser.
Stop using it. Change it everywhere you used it, starting with email and banking, and use a different random password for each account. Turn on two-factor authentication, and save the backup codes offline.
It is not in the known breach corpus, which is good. It can still be weak or guessable, so also run the strength checker, and never reuse it across sites.
