Was Your Password Breached?
Check if your password has appeared in a known data breach. Completely free, instant, and 100% private — your password never leaves your device.
15B+
Breached passwords in database
800+
Data breaches tracked
Zero
Data stored by this tool
Your password never leaves your device. We use k-anonymity: your browser computes a SHA-1 hash and sends only the first 5 characters to the API. The full password is never transmitted.
How does this stay private?
- 1. Your browser computes a SHA-1 hash of the password locally — nothing is sent yet
- 2. Only the first 5 characters of that hash are sent to the HaveIBeenPwned API
- 3. The API returns ~1,000 hash suffixes that start with those 5 characters
- 4. Your browser checks locally whether any suffix matches — the API never sees the full hash or password
What to do if your password was found
Change that password everywhere
Change it on every account you've used it on. Reusing passwords is one of the most common ways accounts get taken over.
Use a unique password per site
Generate a completely random, unique password for every account. No two accounts should ever share the same password.
Enable two-factor authentication
Even if someone has your password, 2FA stops them from getting in. Turn it on for email, banking, and social accounts first.
Check your security health
Run through a full security checklist to make sure no other accounts are at risk.