Have I Been Pwned Password Check
Check if a password appears in known breaches — using k-anonymity. Only the first 5 hex chars of SHA-1 leave your browser.
Privacy guarantee: Only the first 5 hex characters (~20 bits) of your password's SHA-1 are sent. The HIBP server cannot reconstruct your password — this is the k-anonymity protocol.
About Have I Been Pwned Password Check
Type a password and the tool computes its SHA-1 hash in your browser, then queries the Have I Been Pwned range API to see if that hash appears in known data breaches. If there is a match, it shows how many times the password has been seen so you can decide whether to stop using it.
This check uses k-anonymity: only the first five hexadecimal characters of the SHA-1 hash are sent to the API. The password itself and the full hash never leave your browser, and the service returns a list of hash suffixes that your browser compares locally to find a match.
Frequently asked questions
- Is my password sent to the server?
- No. Only the first five characters of its SHA-1 hash are sent; the password and full hash stay in your browser.
- What does the count number mean?
- It is how many times that password has appeared in breach data, so a higher number means it is more widely exposed.
- My password was not found. Is it safe?
- It only means the password has not appeared in known breaches, not that it is strong; a short common password can still be guessed.