Hash the password here
The browser creates a SHA-1 digest and keeps the password and full digest on this device.
Breached password check
Check known breaches using a short hash prefix, not the password itself.
Only five characters leave this page
The password stays here. The prefix is too short to identify a single password among the thousands that share it.
Check
Enter a password
Nothing is typed into a form that submits. If you would rather not test a password you still use, try an old one.
Result
Appearances in the breach corpus
—
Hash prefix sent
—
What happens
The range lookup, step by step
-
Hash in the browser
The password is hashed with SHA-1 in this page. The full digest stays in memory.
-
Send five characters
Only the first five characters go to this site's proxy, which requests the matching range from Have I Been Pwned.
-
Compare locally
The service returns every hash that starts with those characters. Your browser finds the match and discards the rest.
This is an external lookup This server sees the five-character prefix and relays it. The external service sees that prefix and a request from this server, but neither service receives the password or full hash.
Reading the result
A count of zero means the password does not appear in the corpus being searched. It does not mean the password is strong, and it does not mean the account behind it is safe.
A count above zero
Any appearance means the password has been published somewhere, usually through a breach of another service. It should be replaced wherever it is still in use, starting with the account that matters most, and it should not be reused.
Why the hash prefix is enough
Many hash entries share the same first five characters, so a prefix describes a group rather than one entry. The service answers with the whole group and cannot tell which member, if any, was yours.
How it works
Send a short prefix
Only the first five hash characters go through this server to the public breach range service.
Compare locally
The browser checks the returned suffixes and explains the result without sending the password.
Does the site store the password I type?
No. The field is not part of a form and is never submitted. The value is hashed in the page, and the full digest is discarded when you close or reload the tab.
Is this the same as a password manager's report?
It is one check rather than a full audit. A manager can compare every saved password at once and flag the reused ones. This page checks a single password that you type.
What if the lookup fails?
The service is external, so it can be slow or unavailable. When that happens the page reports the failure and shows no count, rather than guessing.