Password Breach Check
Safely check if your password was leaked on the Dark Web using the official Have I Been Pwned database.
Check a Password
Enter a password to see if it has ever been exposed in a data breach. We use k-Anonymity, meaning your actual password never leaves your browser.
Is this safe to use?
Yes. We never see your password. It never leaves your browser, and it is never sent to our servers.
How does it work? (The k-Anonymity model)
- When you type your password, your web browser mathematically scrambles it into a 40-character "hash" (e.g.,
5BAA61E4C9B...). - Your browser then splits that hash and takes only the first 5 characters (e.g.,
5BAA6). - It sends only those 5 characters to the official Have I Been Pwned API.
- The database sends back a massive list of hundreds of broken passwords that happen to start with those same 5 characters.
- Your browser checks if the rest of your scrambled hash is anywhere on that list. If it is, your password was breached.
Because we only ever transmit 5 characters of a scrambled code, it is mathematically impossible for anyone—even us—to figure out what password you typed.
What if my password is breached?
If the tool says "Pwned", you must stop using that password immediately. Hackers use automated bots to test lists of breached passwords across thousands of websites every second. Head over to our Secure Password Generator to create a new, safe password.