How to Check If Your Password Has Been Leaked

Passwords appear in breach data all the time. The useful question is not whether leaks happen. It is whether you know when one of your own passwords has already shown up in a leaked dataset.

A private breach test answers that without sending the password itself. Hash it locally, compare it against known leaks, then decide what to rotate—starting with email if the same secret was reused.

What a Breach Check Can Tell You

A password breach checker compares your password, safely, against known leak datasets. If the password appears there, treat it as compromised even if the original breach happened years ago. Attackers still replay old pairs.

A match does not prove that someone is inside your account right now. It proves that this exact secret is in circulation and should no longer be trusted anywhere you used it.

What a Breach Check Cannot Tell You

• It cannot tell you which site leaked the password, or when.
• It cannot prove that an attacker has already signed in.
• A “not found” result does not mean the password is strong—only that it is not in the known corpus yet.
• It cannot see passwords that leaked privately, in malware logs, or in breaches not yet published.
• It is not a substitute for unique passwords, MFA, or a password manager.

How to Run a Private Check

Open the Password Breach Checker. Type or paste the password you want to test, then press Check. Use this for secrets you still rely on: email, banking, Apple/Google/Microsoft, work SSO, and anything you know you reused.

Do not send the password to a random website, paste it into a chatbot, or email it to a “security” address. If a tool asks you to upload the full password, choose a k-anonymity checker instead.

How Privacy-Preserving Checks Work

Good checkers do not send your full password. They hash it in the browser, send only the first five characters of the SHA-1 hash to Have I Been Pwned, and finish the comparison on your device. That is k-anonymity: the service sees a bucket of possible suffixes, not the secret.

With the Add-Padding header, HIBP also adds extra suffixes with a count of 0 so the response size is harder to interpret. Those padded responses contain a random number of records between 800 and 1,000—not a single fixed size.

If the Password Is Found

Change it on the affected account, hunt reuse, start with email, and replace it with a unique secret—not a seasonal tweak. The full sequence is in My Password Was Found in a Data Breach. What Should I Do?

• Change the password on the account you just checked.
• Find every other place you reused it—this is the most important part.
• Start with email, because it can reset everything else.
• Generate a new unique password with our password generator or a passphrase.

If the Password Is Not Found

• Keep using a unique password per account anyway.
• Check strength separately if the password is short or memorable.
• Do not treat “not found” as a lifetime guarantee. Repeat the check after major public breaches, and whenever you reuse a secret you are unsure about.

Make the Check a Habit

Use a password manager so you do not need to reuse passwords. Let it generate random passwords for stored logins and long passphrases for memorized secrets when needed.

Keep the Password Breach Checker in your maintenance loop for email, banking, and other high-value accounts—especially after a service you used announces a leak.