Check a password against known breaches — privately
Pwned Password Checker
Runs entirely in your browser — nothing you type here is sent to our servers.
How this stays private
Your password is hashed with SHA-1 directly in your browser. We only send the first 5 charactersof that hash to Have I Been Pwned's API — this is called k-anonymity. The service returns every breached hash sharing that 5-character prefix (usually hundreds of them), and the match is found locally in your browser. Your actual password, and even your full hash, never leaves your device.
Frequently asked questions
Is it actually safe to type my real password into this tool?+
Yes — your password is hashed with SHA-1 directly in your browser, and only the first 5 characters of that hash are ever sent anywhere. This is called k-anonymity: Have I Been Pwned returns every breached hash sharing that prefix, and the match is found locally. Your actual password never leaves your device.
What does it mean if my password shows up as pwned?+
It means that exact password has appeared in one or more publicly known data breaches — it's now in password lists attackers actively use for credential-stuffing attacks. Change it immediately on every account where you've used it, and avoid reusing it anywhere.
What if my password isn't found — does that mean it's strong?+
Not necessarily. It means this specific password hasn't appeared in a known breach yet — a short or predictable password can still be guessed even if it's never been leaked. Length and randomness matter regardless of breach status.
Where does the breach data come from?+
Have I Been Pwned aggregates hundreds of publicly reported data breaches into a searchable database of over 900 million compromised passwords, maintained by security researcher Troy Hunt and used by browsers and password managers industry-wide.