Password Checker
Check if a password has shown up in known data breaches — without the password ever leaving your browser. Free, no signup. How this stays private.
Nothing is stored, logged, or sent anywhere except a 5-character hash prefix — see below.
How this stays private
Your password is hashed (SHA-1) right here in your browser using the Web Crypto API built into every modern browser — it never travels anywhere. Only the first 5 characters of that hash are sent to HaveIBeenPwned's Pwned Passwords API. Their server returns every breached password hash that starts with those same 5 characters — often hundreds of them — and your browser checks locally whether your full hash is anywhere in that list.
This is the same "k-anonymity" technique used by 1Password, Bitwarden, and Firefox Monitor. HaveIBeenPwned never sees your actual password, and can't reconstruct it from 5 hex characters shared with hundreds of other passwords.
Checks against HaveIBeenPwned's Pwned Passwords database of known breached passwords. A password not found here isn't a guarantee it's strong or unique — only that it hasn't turned up in this particular dataset. We don't offer email/account breach lookup — that HaveIBeenPwned product now requires a paid API key, and we'd rather say so than fake it.