Was My Password Leaked?
Check if a password appears in known data breaches, without sending the password.
Loading…
How can this be private?
Your password never leaves your device. Your browser turns it into a fingerprint (a SHA-1 hash) and sends only the first 5 characters of that fingerprint to the Have I Been Pwned database. It sends back hundreds of possible matches, and your browser checks them itself. Neither we nor the database ever learn your password.
Found in a leak?
- Stop using that password everywhere you used it.
- Change it to a new random one from our password generator, stored in a password manager.
- Turn on two-step login, ideally with an authenticator app like Aegis or a security key.
Not found does not mean safe: it only means it is not in known leaks. Short or common passwords are still easy to guess.