Password Leak Check
Check if your password has been exposed in known data breaches. Your password never leaves your browser — we use the k-anonymity model.
Password compromised!
This password has appeared in data breach(es). If you use this password, change it immediately.
Password not found in leaks
This password was not found in the Have I Been Pwned database of compromised passwords. However, this doesn't guarantee absolute security — always use unique passwords for each service.
Error
How does this work?
- 1 Your password is hashed with SHA-1 directly in your browser
- 2 Only the first 5 characters of the hash are sent to the Have I Been Pwned API (k-anonymity model)
- 3 The API returns matching hash suffixes, and the check happens locally in your browser
- 4 Your password is never transmitted — not to us, and not to Have I Been Pwned
What is a Password Leak?
A password leak occurs when a service you use is breached by hackers, and your account credentials — including passwords — are stolen and published online. These leaked databases are widely shared and used in automated attacks against other services.
Why Should You Check Your Passwords?
Over 12 billion compromised accounts are indexed in the Have I Been Pwned database. If your password appears in a known breach, attackers may already be using it in credential stuffing attacks — automated attempts to log into various services using leaked credentials.
What to Do if Your Password is Compromised?
- Change the password immediately on all services where you used it
- Use our password generator to create a strong, unique replacement
- Enable two-factor authentication (2FA) wherever possible
- Use a password manager (e.g., Bitwarden, KeePassXC) to store unique passwords for every account
- Check your email on Have I Been Pwned to see which services were breached
How We Protect Your Privacy
We use the k-anonymity model developed by Cloudflare and Troy Hunt. This means that your full password hash is never sent over the internet. Only the first 5 characters of the SHA-1 hash are transmitted to the API, which returns approximately 500 possible matches. The actual comparison is performed entirely in your browser. This approach was specifically designed to make it mathematically impossible to reconstruct your password from the transmitted data.
About Have I Been Pwned
Have I Been Pwned (HIBP) is a free service created by Australian security researcher Troy Hunt. It aggregates data from publicly known data breaches and allows people to check whether their personal information has been compromised. The Pwned Passwords API contains over 800 million unique compromised passwords.