Password breach check

See whether your password appears in known data breaches. The check is safe — the password is never sent to a server.

🔒 Safe: only the first 5 chars of the SHA-1 hash leave your browser (k-anonymity); the password itself is never sent.

How it stays safe

We compute the SHA-1 hash of your password in your browser and send only its first 5 characters to the breach database (Have I Been Pwned). The server returns all matches for that prefix and the comparison happens locally. This is k-anonymity — your password and full hash never leave your device.

If your password is breached

Change it immediately everywhere it's used and enable two-factor authentication. Create a strong one with our generator, and test it with the strength checker. To hide your traffic and IP, connect the free GANVAS VPN.

FAQ

Is my password sent to a server?›

No. Only the first 5 chars of the SHA-1 hash leave the browser (k-anonymity); the comparison happens locally. The password itself is never sent.

Where does the breach data come from?›

From the public Have I Been Pwned database — the largest aggregator of leaked passwords (billions of records).

Related tools

All tools →

→IP & domain lookup →WHOIS domain & IP →Blacklists & RKN →DNS records lookup →Email checker →My IP address

The app: WireGuard config · VLESS client · Tor VPN · VPN for Windows