Find reused passwords without uploading your password list
A password export can hold many account names and passwords in one readable file. Keep it private and use it only as long as you need it. Password reuse checker reads the file in your browser. The separate Breach check tool makes a network request, so read that step before using it.
1. Check your password manager first
Your password manager may already show reused passwords. If it does, you can review them there without making an export. Otherwise, save its supported CSV export, a table stored as a text file, on a device you control. Avoid shared computers and shared folders. Don't email the file to yourself or send it to support.
2. Open the list in Password reuse checker
Choose your CSV and review accounts that share the same or nearly identical passwords. Also look at the weak-password warnings. The file stays in this tab. Keep the screen private: even masked results show account names, usernames and parts of passwords.
3. Understand the separate breach check
Breach check checks one password when you press Check password. Your browser calculates a code called a SHA-1 hash and sends only its first five characters to this site. The password and full code stay in the browser. This site sees your IP address and those five characters, which may appear in request logs. It asks Have I Been Pwned for matching records; that service sees this site's request rather than your IP address.
4. Change passwords at each service
Start with email and accounts that can reset other accounts. Open each service through an address you trust and give it a different password. Password generator can help. Save the new password in your manager and check that you can sign in before moving on. The checking tools won't change passwords for you.
5. Remove the temporary password list
Press Clear in the reuse checker and close the tab. Delete the readable CSV when you're done, checking for duplicate downloads and cloud copies too. Ordinary deletion may leave copies in backups or on storage devices. Keep using your password manager as your record.
Good to know
The reuse checker uses simple rules to flag weak or similar passwords. A password missing from breach results was only absent from that dataset. Neither check can prove that a password has never leaked or that an account is safe.