Worried a password might already be in the hands of attackers? Enter it above and we'll check it against hundreds of millions of passwords exposed in real data breaches, using the Have I Been Pwned database. The check is privacy-preserving: your password is hashed in your browser and only the first five characters of that hash are ever sent — your actual password never leaves your device.

What is a data breach?

A data breach happens when attackers steal information from a company or service — often including usernames and passwords. Those credentials are then collected into huge lists and traded or published online. If a password you use appears in one of these lists, it is considered "pwned", and attackers will try it against your other accounts in what's called credential stuffing. That's why a breached password is dangerous even if the breach wasn't yours.

How this check protects your privacy

It would defeat the point to send your password to a website just to ask if it's safe. Instead, this tool uses a clever technique called k-anonymity:

1. Your password is hashed with SHA-1 inside your browser.
2. Only the first 5 characters of that hash are sent to the Have I Been Pwned API.
3. The service returns every breached hash that shares those 5 characters — hundreds of them.
4. Your browser checks the full hash against that list locally and shows the result.

The service never sees your password, never sees its full hash, and can't tell which of the returned entries (if any) was yours. Nothing is stored on our side either.

What to do if your password was found

• Stop using it everywhere. Treat it as compromised on every account.
• Change it immediately on any account where you used it.
• Generate a new, unique one with our password generator — a long, random password is never on these lists.
• Use a password manager so every account gets its own unique password.
• Turn on two-factor authentication (2FA) for an extra layer of protection.

What it means if your password wasn't found

A "not found" result is reassuring — it means the password isn't in the breaches Have I Been Pwned knows about. It is not a guarantee the password is strong, though. A short or simple password can still be cracked even if it hasn't leaked yet, so check it with our password strength checker too.

Frequently asked questions

Is it safe to type my password here?

Yes. Your password is hashed locally and only a 5-character fragment of that hash is sent, thanks to k-anonymity. The password and its full hash never leave your browser, and nothing is stored.

Where does the breach data come from?

From Have I Been Pwned, a respected service that aggregates passwords exposed in public data breaches into a searchable, privacy-preserving database.

My password was found — does that mean my account is hacked?

Not necessarily, but it means that password is known to attackers and unsafe to use. Change it anywhere you've used it and switch to a unique, generated password.

Does a "not found" result mean my password is strong?

No. It only means the password hasn't appeared in a known breach. Strength depends on length and randomness — check that separately with the strength checker.