Pwned Password Checker

What this tool does

Pwned Password Checker hashes a password with SHA-1 entirely in your browser, then checks it against the Have I Been Pwned database of over 800 million breached passwords using the k-anonymity range API — only the first 5 characters of the hash are ever sent, so the full password or hash never leaves your device.

Passwords exposed in past data breaches get compiled into huge lists that attackers try first against any account, because a password someone used once in a breached service is very often reused elsewhere, making "has this exact password ever leaked" a genuinely useful question to answer before using it.

This checker uses Have I Been Pwned’s k-anonymity range API: your password is hashed with SHA-1 entirely in your browser, and only the first 5 characters of that hash are sent to the API, which returns every known breached hash sharing that prefix (several hundred), and the match is confirmed locally, meaning your actual password or full hash never leaves your device.

How to use Pwned Password Checker

1. Type or paste the password you want to check.
2. Press Check password.
3. Review the result: breached (with a count) or no match found.
4. If breached, stop using that password anywhere and change it immediately.

Tips for better results

• A "breached" result doesn’t necessarily mean your specific account was compromised, it means that exact password string has appeared in at least one known breach dataset, which still makes it a bad choice for anyone to use, since attackers test these lists against any target.
• A "not found" result is reassuring but not an absolute guarantee of safety, it just means the password isn’t in HIBP’s current compiled breach dataset, still pair it with uniqueness per account and ideally two-factor authentication.
• The k-anonymity design means even Have I Been Pwned’s own servers can’t determine your actual password from the request, only generic statistics about hashes sharing that 5-character prefix.
• Checking a current password is far more valuable than checking a random example; this tool processes everything locally specifically so it’s safe to check real passwords, not just test ones.

Common use cases

• Checking whether a password you currently use anywhere has appeared in a known data breach.
• Vetting a newly chosen password before adopting it for an important account.
• Auditing a list of candidate passwords during a security review.
• Understanding how k-anonymity protects privacy while still enabling useful breach lookups.

Common mistakes to avoid

• Treating a "not breached" result as a complete security guarantee; it only reflects HIBP’s specific compiled dataset, not every password ever exposed anywhere, and strength/uniqueness still matter independently.
• Continuing to use a password confirmed breached "because it’s convenient"; a breached password should be treated as fully compromised and retired immediately from every account using it.
• Assuming this check requires trusting a third party with your actual password; the k-anonymity design specifically avoids that by only ever sending a 5-character hash prefix.