Free tool
Has this password already leaked?
Check a password against a public breach corpus without handing the password over. Your browser keeps the full hash and sends five characters so the lookup cannot identify what you asked about.
Check
Enter a password
Nothing is typed into a form that submits. If you would rather not test a password you still use, try an old one.
Result
What happens
The range lookup, step by step
-
Hash in the browser
The password is hashed with SHA-1 in this page. The full digest stays in memory.
-
Send five characters
Only the first five characters go to this site's proxy, which requests the matching range from Have I Been Pwned.
-
Compare locally
The service returns every hash that starts with those characters. Your browser finds the match and discards the rest.
This is an external lookup This server sees the five-character prefix and relays it. The external service sees that prefix and a request from this server, but neither service receives the password or full hash.
Reading the result
A count of zero means the password does not appear in the corpus being searched. It does not mean the password is strong, and it does not mean the account behind it is safe.
A count above zero
Any appearance means the password has been published somewhere, usually through a breach of another service. It should be replaced wherever it is still in use, starting with the account that matters most, and it should not be reused.
Why the hash prefix is enough
Many hash entries share the same first five characters, so a prefix describes a group rather than one entry. The service answers with the whole group and cannot tell which member, if any, was yours.
Does the site store the password I type?
No. The field is not part of a form and is never submitted. The value is hashed in the page, and the full digest is discarded when you close or reload the tab.
Is this the same as a password manager's report?
It is one check rather than a full audit. A manager can compare every saved password at once and flag the reused ones. This page checks a single password that you type.
What if the lookup fails?
The service is external, so it can be slow or unavailable. When that happens the page reports the failure and shows no count, rather than guessing.