Type the password into the check below. Your browser hashes it and sends only the first 5 characters of that hash to Have I Been Pwned, which returns every leaked hash starting with them. The match is done on your device, so the password itself never leaves it.
Runs on your device
Leaked passwords are tried automatically on other sites (credential stuffing). If one shows up in breaches, attackers already have it on their lists.
Only 5 characters of its SHA-1 hash are sent, which can’t be turned back into the password. That’s the k-anonymity method Have I Been Pwned designed for this.
Not necessarily: it just isn’t in known breaches. The check also estimates strength; long, unique passphrases from a password manager are best.
Change it on every account that used it, starting with email and banking, and turn on two-factor authentication.
The service sees your IP address and those 5 characters, nothing more. The strength estimate runs entirely on this page.
