Check if your password has been exposed in a data breach — safely and privately.
Your password is hashed using SHA-1 entirely in your browser.
Only the first 5 characters of the hash are sent to the HaveIBeenPwned API.
The API returns all hash suffixes matching that prefix (~500–600 results).
Your browser checks locally if the full hash matches any result. Your password never leaves your device.
Powered by Troy Hunt's HaveIBeenPwned Passwords API. This service indexes over 700 million compromised passwords from real data breaches.
Breach Checker tells you whether a password has appeared in a known public data breach without ever transmitting the password itself. You type in a password, the tool computes its SHA-1 hash locally, and it queries the Have I Been Pwned Pwned Passwords range API using only the first five hex characters of that hash, so the full password and full hash never leave your device.
It is used by anyone reusing an old password, IT admins vetting default credentials, and developers checking whether a candidate password is already circulating in breach corpora before allowing it in a signup or reset flow.
Have I Been Pwned exposes over 800 million real-world passwords collected from breaches, indexed by SHA-1 hash. Sending a full password or even a full hash would be risky, so the tool uses a k-anonymity range model. Your password is hashed with SHA-1 to produce a 40-character hex digest, for example 'password' becomes 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
The tool splits that digest into a 5-character prefix (5BAA6) and a 35-character suffix. Only the prefix is sent to the API endpoint api.pwnedpasswords.com/range/5BAA6. The server responds with a list of every stored suffix beginning with that prefix, along with a breach count for each. Your browser then scans that list locally for your suffix. The server never learns which of the several hundred returned candidates was yours, and your actual password is never transmitted.
A match means that exact password string exists in the breach dataset and should be considered compromised regardless of how complex it looks. SHA-1 is used here purely as an index into the dataset, not as a security measure, which is why the range API remains safe: the sensitive comparison happens in your browser.
No. Your password is hashed with SHA-1 in your browser, and only the first 5 characters of that hash are sent to the Pwned Passwords range API. The full password and full hash never leave your device.
Yes, it is completely free and runs in your browser. It uses the public Have I Been Pwned Pwned Passwords API, which is also free and does not require an account or API key for range queries.
It is how many times that exact password appeared across the breaches aggregated by Have I Been Pwned. A higher count means it is more widely known and more likely to be tried in credential-stuffing attacks.
It means the password has not appeared in the breach corpus, which is a good sign, but it is not a guarantee of strength. A short or predictable password can still be cracked. Check it with a Password Strength tool as well.
Because of the k-anonymity design your password stays private, so testing is safe. If you are cautious, test a variant or use it mainly to vet new passwords before adopting them.
SHA-1 is only used as a lookup index into the breach dataset, not to protect your password. The privacy protection comes from the range query and local suffix matching, not from the hash algorithm's strength.
Stop using it on every account, create a new unique password, and change it wherever it was reused. Enabling two-factor authentication adds further protection against stolen credentials.