More
More
Has My Password Leaked?
Checks a password against known breaches without ever sending it.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
How it stays private: your browser turns the password into a SHA-1 fingerprint and sends only its first 5 characters to the free Pwned Passwords service run by Have I Been Pwned. The service returns every leaked fingerprint that starts the same way, and the match is checked here on your device. The password itself never leaves your browser.
How to use it
- Type or paste the password and press Check.
- If it has appeared in a breach, stop using it everywhere and change it on every account that shares it.
- Turn on two-step sign-in where you can, and use a different password for every site.
Questions
Is it safe to check my password here?
Yes. Only the first 5 characters of a SHA-1 fingerprint of the password are sent, which matches hundreds of different passwords, and the comparison happens in your browser. This is the k-anonymity method Have I Been Pwned designed for exactly this check.
My password was found. What now?
Change it on every site where you use it, starting with email and banking. Attackers feed leaked passwords into automated sign-in attempts across many sites.
It was not found. Is it safe?
Not necessarily. It only means it is not in the breaches the service has collected. A short or guessable password can still be cracked.
Can I check my email address too?
Email lookups need a paid key from Have I Been Pwned and a server request, so this tool checks passwords only.
About this tool
About the password leak check
Billions of passwords have been exposed in data breaches, and attackers feed those lists straight into automated sign-in attempts. This tool tells you whether a password you use is already on those lists, so you know to change it.
How it checks without seeing your password
- Your browser turns the password into a SHA-1 fingerprint.
- Only the first five characters of that fingerprint are sent to the free Pwned Passwords service run by Have I Been Pwned.
- The service returns every leaked fingerprint that starts the same way, often hundreds of them.
- Your browser compares the full fingerprint against that list on your device.
The service never learns which password you checked, or even its full fingerprint. This method is known as k-anonymity.
If your password was found
Stop using it everywhere, starting with your email account, since that is the key to resetting everything else. Change it on every site where you used it, and turn on two-step sign-in where you can.
If it was not found
That only means it is not in the breaches collected so far. A short or guessable password can still be cracked, so check its strength too.
Your password itself never leaves your browser.
Related tools
- Password GeneratorStrong random passwords, passphrases and custom random strings, made on your device.
- Password Strength CheckerHow long a password would take to crack, checked without sending it anywhere.
- 2FA Code GeneratorTime-based one-time codes from a setup key.
- Email Header AnalyserPaste an email's headers to see where it really came from and whether it passed SPF, DKIM and DMARC.