Breach Check
Checks whether a password appears in Have I Been Pwned’s breach data, sending only the first five characters of its SHA-1 hash from the browser (k-anonymity).
A password that appears in a public breach corpus is not weak — it is already known, and no amount of length or entropy fixes that. This checks yours against Have I Been Pwned’s Pwned Passwords set without the password, or a full hash of it, ever leaving the tab.
The password is hashed with SHA-1 in this tab, and only the first five characters of that hash are sent to Have I Been Pwned (k-anonymity). The service returns several hundred breached hashes sharing that prefix, and your browser checks whether yours is among them. Our server plays no part in any of it.
The e-mail breach lookup is not offered here: Have I Been Pwned requires a paid API key for it and it is not k-anonymous. You can run it yourself at haveibeenpwned.com.
How to use it
Type the password
It is hashed with SHA-1 in the browser. Only the first five hex characters of that hash are sent.
The service returns a range, not an answer
Several hundred breached hashes share that prefix. They all come back, and your browser looks for yours in the list — the service never learns which one it was, or whether it was there at all.
Act on a hit immediately
A count above zero means change it everywhere it was used, not only where you noticed. The count itself is how many breach records contain it, not how many times you were breached.
Common questions
Does my password reach anyone’s server?
No. Five hex characters of a SHA-1 hash go out; that prefix is shared by hundreds of thousands of possible passwords and cannot be reversed. The request goes from your browser straight to the API — this site’s server is not in the path.
Can I check an e-mail address for breaches?
Not here. The e-mail lookup requires a paid API key and cannot be done k-anonymously, so it is not offered rather than done badly.
Not found. Is the password safe?
It means it is not in this corpus. Breaches that were never published, or never made it into the set, are not covered — and a password absent from every list can still be weak. Run it through the strength meter too.
Why SHA-1, which is broken?
Because the published corpus is indexed by SHA-1 and the protocol is defined that way. Collision resistance is not what is being relied on here — the hash is a lookup key, not a password store.
Feed it from
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
Disposable Email
Gives you a throwaway inbox that receives mail for a limited time, with attachments viewable in place.
Password Export Converter
Converts a password-manager CSV export between 1Password, Bitwarden, Chrome/Edge, KeePass, KeePassXC and LastPass layouts, with the column map for each documented.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Next
These accept what this tool produces, so the result can go straight in.
Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
Disposable Email
Gives you a throwaway inbox that receives mail for a limited time, with attachments viewable in place.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.
Date Difference
Counts days, weeks, months and years between two dates, with a D-day view and business-day option.