This tool checks a password against the Have I Been Pwned database of over half a billion leaked passwords. Your password never leaves your browser: only a small fragment of a fingerprint is sent.
What this tool does
The tool computes a SHA-1 fingerprint of your password locally and sends only its first five characters to the service. The comparison of the rest happens in your browser via k-anonymity.
How to use it
Type or paste a password in the field. If it appears in a breach, stop using it everywhere and enable two-step verification.
Input and output
- Input: a password (stays in your browser)
- Output: whether the password appears in known breaches and how often
Limitations
The check only covers passwords in known, collected breaches; a password that is not found is not automatically safe. Always use unique, long passwords.
Good to know
Change a leaked password everywhere you used it, not only on the service where the breach happened. A password manager helps you keep a unique and long password per account without memorising them.