FREE SECURITY TOOLS
Password Breach Checker
Find out if your password has appeared in a known data breach. Powered by the Have I Been Pwned database — over 900 million compromised passwords checked instantly.
Your password never leaves your device. We compute a SHA-1 hash in your browser, then send only the first 5 characters to the API (k-anonymity). The full hash and your password are never transmitted.
How does the breach checker work?
This tool uses the Have I Been Pwned Passwords API with a technique called k-anonymity to protect your privacy:
- Your browser computes a SHA-1 hash of your password locally
- Only the first 5 characters of that hash are sent to the API (not your password, not the full hash)
- The API returns all breach hashes that start with those 5 characters (~500 results)
- Your browser checks locally whether the rest of your hash is in that list
- The result is displayed — your full password and hash never leave your device
This is the same approach used by 1Password, Firefox Monitor, and other trusted security tools.
What should I do if my password is breached?
- Change the password immediately on any account that uses it
- Generate a new, unique password — never reuse the old one
- Check whether other accounts use the same or similar password
- Enable two-factor authentication (2FA) where available
- Consider using a password manager to maintain unique passwords everywhere