Password Breach Checker

Check if your password has appeared in known data breaches free online, using the real Pwned Passwords API with k-anonymity. Your actual password is never transmitted.

How to Use This Tool

Type the passwordEnter the password you want to check

Click Check for BreachesOnly a hash prefix is sent via k-anonymity

Review the resultSee if and how many times it appears in known breaches

Password Breach Checker is a free online tool that works entirely in your browser — no signup, no data uploaded, no limits.

Checking Breach Status Without Exposing Your Password

Sending a real password to any third-party service, even to check if it's been breached, sounds like exactly the wrong move -- and it would be, if that's what actually happened. This tool uses k-anonymity, the same privacy-preserving technique Troy Hunt's Have I Been Pwned built specifically for this purpose: your password is hashed locally with SHA-1, and only the first 5 characters of that hash get sent to the API.

The API responds with every breached-password hash that shares that same 5-character prefix -- typically hundreds of candidates -- and the final matching against your full hash happens locally in your browser. The API operator never sees your actual password, your full hash, or even enough information to know which specific password among those hundreds of candidates you were checking.

Why a Match Matters Regardless of Whether You Were Personally Breached

Attackers running credential-stuffing attacks do not target specific people -- they take massive lists of previously breached username and password combinations and try them against many services at once. If your password happens to match one in that list, it's a target for this kind of automated attack regardless of where the original breach came from or whether you were ever notified about it.

This Complements, Rather Than Replaces, Strength Checking

A password could be absent from this breach corpus while still being weak and easily guessable through other means, or present in the corpus despite looking complex, simply because someone else happened to choose the identical string. Breach checking and strength analysis answer different questions and are both worth doing.

Frequently Asked Questions

It uses k-anonymity, a technique used by the real Have I Been Pwned Pwned Passwords API. Your password is hashed with SHA-1 locally in your browser, then only the first 5 characters of that hash are sent to the API. The API returns all breach-database hashes starting with those 5 characters, and the matching against your full hash happens locally -- your actual password and even your full hash never leave your device.

Yes -- unlike Have I Been Pwned's other APIs (email and domain breach search, which require a paid subscription), the Pwned Passwords API specifically remains free and does not require an API key, precisely because of this privacy-preserving k-anonymity design.

It means that exact password has appeared in at least one known data breach and is in a list that attackers commonly use for credential-stuffing attacks. This applies even if you've never personally been part of a breach -- if your password matches one that someone else used and got breached, it is still flagged.

No. It means it hasn't appeared in this specific breach corpus yet, not that it's inherently strong. A weak but unusual password might not be in the database, while a strong password could theoretically appear if anyone, anywhere, happened to choose the exact same one. Use this alongside, not instead of, an actual strength check.

K-anonymity is specifically designed so that the 5-character prefix matches thousands of other possible passwords, meaning the API operator cannot determine which specific password you checked -- different from being told the actual password or even the full hash, which would uniquely identify it.