Check if a password has been leaked
Check whether your password appears in known data breaches. It is never sent: only a fragment of its fingerprint leaves your browser.
The password never leaves your browser: only the first 5 characters of its fingerprint (SHA-1) are sent to Have I Been Pwned.
In front, a strip with the 40 cells of a password's fingerprint; the first 5 form a loose piece. Behind it, a filing cabinet with eight drawers. The 5-cell piece travels to the cabinet, a drawer of cards opens and a lamp lights up. Enter, Space or the arrow keys move from one step to the next.
How to use it
- Type the password you want to check.
- Click “Check”.
- If it appears in a breach, stop using it and change it on every account where you have it.
Frequently asked questions
Is my password sent anywhere?
No. Your browser computes its fingerprint (SHA-1) and sends only the first 5 characters to Have I Been Pwned, which returns hundreds of fingerprints that start the same way. The search for yours happens on your device.
Where does the data come from?
From the Pwned Passwords service by Have I Been Pwned, which gathers hundreds of millions of real passwords exposed in breaches. When you query it, that service sees your IP address, like any website you visit.
What should I do if my password appears?
Change it on every account where you use it, starting with your email and your bank, and turn on two-step verification. Use a different password for each account.
If it does not appear, is it safe?
Not necessarily: it only means it is not in the known breaches. A short or easy-to-guess password is still weak.
What a password breach is
When a service suffers a data theft, its users’ passwords end up circulating in lists that are sold and shared. Attackers gather them into huge dictionaries and try them automatically on other services: this is known as credential stuffing.
That is why a leaked password is unsafe even if it is long and complicated, and even if the breach was not of one of your accounts: if someone else used that same password and it leaked, it is already in the dictionaries.
How it is checked without sending the password
The method is called k-anonymity. Your browser computes the SHA-1 fingerprint of the password, a 40-character string, and sends only the first 5 characters to the Pwned Passwords service. The service replies with every leaked fingerprint that starts the same way, several hundred of them, and your browser looks for yours in that list.
The service receives neither the password nor its full fingerprint, and with 5 characters it cannot tell which of the hundreds of candidates you were looking for. The result shows how many times the password appears in known breaches.
What to do depending on the result
If it appears, even once, stop using it everywhere. Change it first on your email, because whoever controls your email can reset the passwords for everything else; then on your bank and on accounts holding payment details.
If it does not appear, all you know is that it is not in the breaches known to date. It still needs to be long, random and different for every account.
