Password Breach Checker
Check if a password appeared in data breaches via the Have I Been Pwned range API. Only the first 5 characters of its SHA-1 hash leave your browser.
Uses the Have I Been Pwned range API with k-anonymity: only the first 5 hex characters of the SHA-1 hash leave your browser, and the match against the returned suffixes happens locally.
This tool sends your query to an external service to get live data.
What is Password Breach Checker?
This tool tells you whether a password appears in Have I Been Pwned's Pwned Passwords database of passwords exposed in real data breaches, and how many times. It uses k-anonymity, so neither the password nor its full hash is ever sent.
How to use Password Breach Checker
- Type the password into the Password field.
- Click Check breaches.
- Read the result: how many times it was seen in breaches, or not found.
- Compare the SHA-1 hash and the 5-character prefix that was actually sent.
Example
password
SHA-1 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8; prefix sent: 5BAA6; found in data breaches millions of times
The exact count changes as Have I Been Pwned adds new breaches.
When to use Password Breach Checker
Use it before adopting a password and whenever you suspect an old password was leaked. A password that is not found can still be weak; check its strength too. Requires an internet connection.
How Password Breach Checker works
The browser computes the SHA-1 hash of the password with Web Crypto, sends only the first 5 hexadecimal characters to https://api.pwnedpasswords.com/range/{prefix}, and receives several hundred hash suffixes with their counts. The full hash is compared against these suffixes locally. Because thousands of passwords share each prefix, the service cannot tell which one you checked.
Common Use Cases
- Checking whether an old password appears in known breaches
- Validating a new password before using it
- Demonstrating k-anonymity in security training
- Spot-checking passwords against breach data as NIST recommends
Security Note
This tool sends the 5-character SHA-1 prefix to api.pwnedpasswords.com (Have I Been Pwned). No other data is transmitted.
FAQs
Is it safe to type my password here?
Only the first 5 hex characters of the SHA-1 hash are sent to Have I Been Pwned; the password and full hash stay in your browser. You can verify this in your browser's network tab.
What does it mean if my password is found?
It is in attackers' wordlists. Stop using it everywhere, even if the breach was on another site.
Does 'not found' mean my password is safe?
It only means it is not in the Pwned Passwords dataset. It can still be easy to guess.
Why SHA-1?
The Pwned Passwords API indexes passwords by SHA-1. Here SHA-1 is only used as a lookup key, not to store passwords.