Leaked password checker
Checks whether a password appears in Have I Been Pwned's list of passwords exposed in data breaches. Your password never leaves this page: only the first 5 characters of its SHA-1 hash are sent.
Only 5 characters of a hash are sent, never the password
The breach list only says how often a password was seen, not which site leaked it, because it's built so that passwords can't be traced back to people. To see which breaches your email address was in, use Have I Been Pwned (by email)
How it works
Your password is hashed with SHA-1 in your browser. Only the first 5 characters of that hash are sent to the Pwned Passwords service run by Have I Been Pwned. It replies with every leaked hash that starts with those 5 characters (hundreds of them), and this page looks for yours among them. This method is called k-anonymity: the service never learns your password or even its full hash.
The list holds hundreds of millions of real passwords collected from public data breaches. If yours is in it, attackers have it in the word lists they try first, even if it looks strong.
Questions people ask
Can it tell me which website leaked my password?
No. The password list is deliberately kept separate from breach names, so passwords can't be linked back to people. To see which breaches your email address appeared in, search it on haveibeenpwned.com.
My password was found. What should I do?
Change it everywhere you used it, starting with email and banking, and turn on two-factor authentication. Use a different password for every site, ideally from a password manager.
My password wasn't found. Is it safe?
It hasn't appeared in a known breach, which is good, but it can still be weak. Check it with the password strength checker too.
More free tools
Found a bug or want another tool? Contact