Password Breach Checker

Check whether your password has appeared in known data breaches. The password is hashed locally in your browser and never sent to us or Have I Been Pwned.

Want the full picture first? Read How to Check If Your Password Has Been Leaked.

Privacy-first security check

Private password breach test · No password upload

We never store your password. Checks run locally and send only a small hash prefix to HIBP.

How it works

K-anonymity keeps your check invisible

Only a hashed fragment ever leaves your browser. HIBP returns possible matches and your device makes the final comparison, so the full secret never travels.

  • Local hashing: your password is hashed using SHA-1 directly in the browser.
  • Prefix lookup: only the first 5 hash characters are sent to HIBP.
  • Local comparison: the returned list is checked on your device, keeping the full hash private.
  • Transport security: every request is wrapped in HTTPS/TLS.
  • Response padding: We send the Add-Padding header. HIBP then adds extra hash suffixes with a count of 0 so response size is harder to interpret. Padded responses contain a random number of records between 800 and 1,000—not a single fixed size.

How the privacy-preserving check works

k‑Anonymity password breach checkYour browser hashes a password, sends only the first five characters of the SHA-1 hash to HIBP, receives matching suffixes, and verifies locally whether any suffix matches.1Hash your password & send prefixYour BrowserSHA‑1 (password) → 5BAA61E4C9…FD8prefix = 5BAA6suffix = 1E4C9B93F3…FD82Filter by prefix → return candidatesHIBP (range endpoint)Returns suffix list for prefix 5BAA6F0E1D2C3B4…682 : 12034A92B9333…ADC : 301AB12CD34EF…F83 : 3Send only the prefix via HTTPSSuffixes with 5BAA6 as prefix3Confirm locally: does suffix match?No match (not found)

Frequently Asked Questions