Password leak check
Find out whether your password has appeared in a known data breach. Your password never leaves the browser: it is hashed locally, and only the first five characters of the hash are sent (k-anonymity). Free and no sign-up.
How it works
Privacy comes from how the check is built, not from a promise.
Stays in your browser
The password is hashed locally with SHA-1. The plain password is never sent to us or anyone else.
k-anonymity
Only the first 5 characters of the hash are queried — hundreds of values match that prefix, so your exact password is never revealed.
Nothing is stored
No logs, no accounts, no history. Check as many passwords as you like.
What to do if your password is compromised
- Change it everywhere you used it — starting with email and banking.
- Never reuse one password across sites. A breach on one service must not open the others.
- Make passwords long and unique — a phrase of a few random words beats a short string of symbols.
- Enable two-factor authentication wherever it is available.
- Use a password manager — it creates and stores unique passwords for you.
FAQ
Can you see my password?
No. The password is hashed right in your browser, and only the first 5 characters of the hash are sent. Hundreds of possible hashes match that prefix, so your exact password can never be identified.
Where does the breach data come from?
From the Pwned Passwords database by Have I Been Pwned — hundreds of millions of passwords from real breaches. The tool checks your password hash against it without revealing the password.
If my password is not found, is it safe?
Not necessarily. Not appearing in known breaches is a good sign, but new breaches happen constantly and a short password can be guessed without one. Always use long, unique passwords.
Is it free and without sign-up?
Yes. The check is free, requires no account and stores nothing.
