Password check
See whether a password has shown up in a data breach, and get a rough strength estimate. Your password never leaves this page — only the first 5 characters of its hash do.
What leaves your device
k-anonymity
- 1 · Hash here. Your browser turns the password into a 40-character SHA-1 hash. The password itself never leaves.
- 2 · Send 5 characters. Only the first 5 hex characters of that hash go to Have I Been Pwned — shared by hundreds of other passwords.
- 3 · Match here. The service returns every breached hash with that prefix, padded with decoys. Zcan looks for yours locally.
The service sees your IP address and those 5 characters, nothing more. The strength estimate runs entirely on this page.