Password Breach Checker
Check if your password has appeared in a known data breach — without ever sending your password to anyone.
Your privacy is safe: your password is turned into a SHA-1 hash inside your browser, and only the first 5 characters of that hash are sent to the Have I Been Pwned database. The password itself — and even the full hash — never leaves your device, is never logged, and is never stored.
What to do if it was found: change this password immediately on every account that uses it, turn on two-factor authentication where available, and use a unique password for each account.
How to use
- Type the password you want to check (it stays only on this page).
- Click Check for breaches.
- Read the result: found in how many breaches, or not found at all.
Tips for strong passwords
- Use at least 12 characters with a mix of letters, numbers and symbols.
- Never reuse the same password on more than one account.
- A long phrase of random words is both easy to remember and hard to guess.
Frequently Asked Questions (FAQ)
How does the password breach checker protect my password?
Your password is hashed with SHA-1 inside your browser and only the first 5 characters of the hash are sent to the breach database. The full password or full hash never leaves your device.
What does it mean if my password was found?
It means the password appeared in at least one known data breach. You should stop using it everywhere and change it on every account where it is used.
What does it mean if my password was not found?
It means the password has not appeared in the known breaches checked by the service. It does not guarantee the password is strong or unbreakable.
Can I reveal the password while typing?
Yes. The Show button reveals the typed password so you can check for typos before running the breach check.