Pwned Password Check
Check if a password appears in known data breaches without sending the password.
Looks up live data Your password is hashed in your browser. Only the first 5 characters of the SHA-1 hash are sent to our server, which asks Have I Been Pwned for the matching list and returns it to you. We do not store your password, its hash or your request; the public answer for a prefix may be cached for about a minute. The password and full hash never leave your device.
Your password is hashed in this page. Only the first 5 characters of the hash are sent, to our server and from there to Have I Been Pwned, which answers with every leaked hash that starts the same way (hundreds of them). The match is found here. The password and its full hash never leave your browser.
Report a problem with this tool
About this tool
Billions of passwords have leaked in data breaches, and attackers try those first. This tool checks a password against the Pwned Passwords list kept by Have I Been Pwned (over 900 million leaked passwords) in a way that keeps the password private. Your browser turns the password into a SHA-1 hash, then sends only the first five characters of that hash to our server. Our server asks the breach service for every leaked hash that begins with the same five characters, which is several hundred entries, and sends the list back; your browser looks for the rest of your hash in it. Because the service only ever sees a five-character prefix shared by hundreds of different passwords, it cannot tell which one, if any, you checked. The password and its full hash never leave your device, and our server does not keep a record of what you checked (the public answer for a five-character prefix may be cached for about a minute). A result of not found does not prove a password is safe, only that it is not in known leaks: length and randomness matter more, so use a password manager to generate long random ones. If your password is found, stop using it everywhere. Counts come from the breach service and change as new breaches are added.
How to use it
- Type or paste the password. Use Show to check what you typed.
- Press Check.
- If it was found, change it everywhere you used it and use a long random password from a password manager.
- If it was not found, still prefer long and random: the check only covers known leaks.
Common problems
- It says not found but I know the password is weak
- The list contains only passwords that were leaked in breaches. A weak password that has not leaked is still guessable. Check its strength with the password strength test.
- It says the service did not answer
- The breach service or our server may be busy. Wait a few seconds and press Check again.
- Is it safe to type my real password here?
- The password is hashed in your browser and never sent, but the safest habit is to check old or similar passwords, or ones you are about to retire, rather than your current main password.