Password Breach Checker

How the compromised password check works

This tool checks your password against a database of over 700 million credentials exposed in data breaches. It uses the Have I Been Pwned (HIBP) Pwned Passwords API, which aggregates leaked credentials from thousands of publicly known breaches.

Your password is SHA-1 hashed entirely in your browser. Only the first 5 characters of the hash are sent to the API, which returns all matching hash prefixes. The comparison happens locally, so your full password never leaves your device. This approach is called k-anonymity.

What is k-anonymity in breach checking

K-anonymity is a privacy model that prevents the API from knowing which password you are checking. When you submit a query, the API receives a hash prefix that matches hundreds of other hashes. It returns all matches for that prefix, and your browser checks locally whether your specific hash appears in the list. Even if the API were compromised, an attacker could not determine your password from the prefix alone.

What to do if your password is breached

• •Change the compromised password immediately on every service where you used it.
• •Use a unique, high-entropy password for each account. Check strength with our password strength analyzer.
• •Enable multi-factor authentication (MFA) to protect accounts even if credentials leak again.
• •Use a password manager to generate and store unique passwords for every service.
• •Monitor your accounts for unauthorized activity in the days following a breach discovery.

Frequently asked questions