Tools · Passwords

IS YOUR PASSWORD IN A BREACH?

A comparison against passwords from publicly known breaches. The hash is computed in your browser; only its first five characters leave, the password never does.

The check compares the password you enter against a list of passwords that have turned up in publicly known data breaches. It answers a single question: is this string one of the passwords attackers try first?

The whole computation runs in your browser and neither the password nor its hash reaches us. How the page itself is loaded and measured is a separate matter, described below in the section on how the check works. On a shared or borrowed computer, though, it is better not to type in a password you actually use — a malicious browser extension can read the contents of that field just as it can with any other form.

The check is indicative The tool compares the string you enter against a publicly available list of passwords from breaches. It does not look at your accounts, does not find out where you use the password, and says nothing about whether anyone got into any of your services. Not finding the password on the list is no confirmation that it is safe — the list holds only what became public, and a good many breaches never do.

The password is not sent anywhere. The hash is computed in the browser and only its first five characters leave.

What to do now

  • Change the password everywhere it works. Start with the accounts the rest are recovered through — email, your password manager, the domain registrar account, banking access.
  • Do not go looking for which service gave it away. The lists are assembled from many breaches and a complete stranger may have used the same string; a hit on its own is no proof that the service where you use the password was broken into.
  • Do not turn it into a variant. Adding a digit or a punctuation mark at the end does not help — password cracking tools try those variations automatically, because people make them in almost exactly the same way.
  • A separate password for every service. An attacker will try the same address-and-password pair elsewhere — this is called credential stuffing and it is the most common way accounts get taken over today.
  • Turn on a second factor wherever the account matters. It is the fallback for the case where the password leaks after all.
  • Use a password manager to keep passwords unique. Length and randomness then stop being something you have to work out in your head, and changing a password after a breach takes minutes.

How the check works

What leaves and what does not

The check is built on an approach called k-anonymity. The point is to get an answer without the other side learning what you asked about.

01

The hash is computed on your device

The browser computes a SHA-1 hash of the password. The computation runs on your device: neither the password nor its full hash leaves the browser, and neither is sent to our server — only the first five characters of the hash go out, and they go straight to the service holding the list, not through us. Meanwhile the rest of the page behaves like any other page on the web: our own traffic measurement starts only after you accept cookies, but the Google Analytics script loads regardless of consent whenever it is enabled on the site, so Google sees your IP address either way. None of that has anything to do with the contents of the field — neither the password nor the hash ends up in any of those requests.

02

Five characters go out

Of the forty characters the hash has, the first five are sent. The request goes straight from your browser to the Pwned Passwords service of the Have I Been Pwned project, which maintains the list.

03

A whole batch comes back

The service returns every hash that starts with the same five characters, typically hundreds of records. The rest of the hash is compared in your browser again, so the other side cannot tell which one was yours — or whether yours was there at all.

04

What the other side does see

Your IP address, the time of the request, your browser headers and those five characters. The password cannot be derived from the prefix, but it is still a piece of data someone receives about you. So this is not complete privacy, only substantially less exposure than sending the password or the full hash.

5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8

Goes out Stays in the browser

An example using the hash of a common password. The first five characters are the entire request; the rest is never sent anywhere and is compared locally.

Neither the password nor the full hash leaves the device — that is exactly as much as can be claimed about the privacy of this check. Anyone bothered even by the prefix and the IP address can use the same check built directly into password managers. SHA-1 is not here to protect the password but as a way to compare two strings without revealing them; it is not used for storing passwords and should not be.

More tools

What you can check right away

Password and passphrase generator Found your password in a breach? Here is a new one — random, with the entropy shown, generated entirely in the browser. Email domain security SPF, DKIM and DMARC from public DNS. Can fraudulent mail be sent in your domain name? Website security headers What a site tells the browser: enforced HTTPS, content policy, framing protection.
Content valid as of 8 August 2026

Passwords are only one layer

A leaked password is dealt with
before it happens —
by settings and by people.

Checking one password is a quick answer to one question. Rolling out a password manager, a second factor and rules for accounts is something a security assessment can work through.

Write to us →