Breach Check
Has this password been leaked?
Checks your password against over a billion passwords exposed in real data breaches. Your password never leaves this page.
What just happened
-
Your password was turned into a fingerprint on this device
A SHA-1 hash: 40 characters that can't be directly reversed. (Hashes of common passwords can be looked up in precomputed tables, which is why the full hash is never sent either.)
-
Only the first 5 characters were sent:
The other never left your browser. Thousands of different passwords share these first 5 characters, so they don't identify yours.
-
The service replied with hashes
Every leaked hash starting with those 5 characters, plus fake ones mixed in so the size of the reply gives nothing away.
-
Your browser searched that list itself:
The service never learns which hash you were looking for, or whether there was a match. This technique is called k-anonymity.
Why you can trust this page
- Nothing is stored, logged or tracked. No cookies, no analytics.
- The page's security policy only allows it to contact one server,
api.pwnedpasswords.com, and the form can't be submitted anywhere. - All the code is public: github.com/Ezashi9/breach-check.
Even so, the safest habit is never typing a real password into a site you don't control. Try it with example passwords like password123 or letmein.