Tools / Breached password checker
Password breach checker & generator
Has this password appeared in a known data breach? Checked privately in your browser — the password itself is never sent anywhere.
Check a password
How your password stays private
Your browser computes a SHA-1 hash of the password and sends only its first 5 characters to Have I Been Pwned. The service replies with every breached hash that starts with those characters (hundreds of them, padded with decoys), and your browser looks for a match locally. Neither we nor Have I Been Pwned ever see your password or its full hash. This page does not send anything to our server and stores nothing.
If it was found
- Stop using it everywhere — attackers try leaked passwords on other sites (“credential stuffing”).
- Use a password manager and a unique password for every account.
- Turn on passkeys or two-factor authentication where offered.
Run a login or customer portal? We test authentication and credential-stuffing defences.
Breach data: Pwned Passwords by Have I Been Pwned, licensed under CC BY 4.0.