Password Breach Checker

How this works

This checker queries the Have I Been Pwned password database using a technique called k-anonymity. The idea in one sentence: you can ask a server a question about your data without telling the server what your data is.

Here's the analogy. Imagine you want to know whether a particular book sits in a library, but you don't want the librarian to learn which book you care about. Instead of naming it, you ask for the catalogue cards of every book whose title starts with the same five letters as yours. The librarian hands over a few hundred cards and learns nothing. You take the list home and check your own book privately.

That is exactly what this page does. Your browser hashes whatever you type with SHA-1, a one-way function that turns the password into 40 hexadecimal characters which cannot be reversed back to the password. Only the first five of those characters are sent to the API. The server replies with every hash suffix in its breach data that starts with those five characters - a few hundred lines, each with a count - and your browser compares the remaining 35 characters locally on your device. The password itself never leaves this tab.

You don't have to trust that claim. Open your browser's developer tools, run a check, and watch the network tab. The only request you will see carries a five-character hash prefix, meaningless on its own, and the response is a generic list that matches thousands of possible passwords at once.

What to do if your password shows up

Don't panic. A hit means your password appears in old, public breach collections - data attackers have traded and merged for years. It does not mean someone is inside your account right now. But treat the password as burned, permanently. Never use it again, anywhere, in any variation. Attack tools automatically try leaked passwords with digits appended, letters swapped, and common prefixes bolted on; tweaking a breached password is not a fix.

Then rotate it everywhere it was used, working outward from your email:

• Email first. Your mailbox is the reset key for every other account; whoever holds it can take the rest.
• Every account that shares the password. If you reuse passwords, the list is longer than you think - a password manager's audit feature will find the duplicates for you.
• Turn on two-factor authentication as you go, starting with email, banking, and work accounts. Prefer an authenticator app or hardware key over SMS.
• Watch for signs the old password was already used: login alerts you don't recognize, password-reset emails you never requested, sent messages you didn't write.

If you spot any of that, move quickly - the response steps in signs you've been hacked and the business email compromise playbook walk through exactly what to do, in order.

What makes a good password in 2026

Attackers break passwords two ways: stuffing credentials leaked from other sites, and brute-forcing short ones with rented GPUs. The old rules - swap in numbers, add an exclamation mark, change it monthly - were written for a different era and mostly produce passwords that are hard to remember and easy to guess. What actually holds up:

• Length beats complexity. Every extra character multiplies the attacker's work. Five random words beat a 'clever' mixed-character password by an absurd margin, and you can actually remember them.
• Unique per account. One breached site should never put another account at risk. Reuse is how a forgotten forum leak becomes a drained bank account.
• Use a password manager. It generates a long random password for every account and stores it, so your memory only carries one strong passphrase. The built-in kind in your browser is a fine start.
• Add two-factor authentication. Prefer an authenticator app or hardware key over SMS, which can be hijacked through SIM swapping. With 2FA on, a leaked password alone gets an attacker nothing.

One nuance: passphrases only work if the words are chosen randomly. Human-picked 'random' words rarely are - we reach for the same familiar nouns, which is exactly what attacker wordlists are built from. Let the manager generate things.

More checks

This checker is one of several free tools. The email breach check answers the next obvious question - whether your address itself appears in known breach dumps - and the tools page collects all of them in one place. Passwords are only one layer of an attack surface; if you want the rest tested the way an attacker would test it - web applications, network exposure, Active Directory - see the services page.