247999.XYZ Tools / Protect / Breach check Sign inCreate account

Breach check

Check whether a password appears in known data breaches without sending it anywhere. Only the first 5 characters of its SHA-1 hash leave your browser.

How the check stays private

  1. Your browser hashes the password with SHA-1. The password itself never leaves this page.
  2. Only the first 5 characters of that 40-character hash are sent. Hundreds of different leaked passwords share any given prefix.
  3. We fetch the list of matching hash endings from Have I Been Pwned, and your browser looks for your full hash in it.

Requests go through our server, so the breach database never sees your IP address, and we never see more than the 5-character prefix.

Questions

My password was found. What now?

Stop using it everywhere it appears. Attackers try leaked passwords on other sites first. Generate a new one with the password generator and store it in a password manager.

It wasn't found. Is it safe?

It means it isn't in the known breach collections. It could still be weak; length and randomness matter most.