Has my password been leaked?

Check a password against the hundreds of millions exposed in real data breaches, using the Have I Been Pwned Pwned Passwords service, without sending the password anywhere.

What leaves your device: 5 hex characters of the password's SHA-1 hash, sent straight from your browser to api.pwnedpasswords.com. Not the password, not the full hash, and nothing goes to PassCheck's server.

How a lookup can work without revealing the password

This method is called k-anonymity range search. Step through it with a demo password.

You type a password. It sits in a text box on your device. Nothing has been sent yet.

Your deviceletmein
api.pwnedpasswords.comsees: nothing

Method designed by Troy Hunt with Cloudflare; described in the Have I Been Pwned API documentation. NIST SP 800-63B asks services to check new passwords against breach corpuses like this one.

Breach check FAQ

Does this send my password to Have I Been Pwned?

No. Your browser computes the SHA-1 hash of the password, sends only the first 5 hexadecimal characters of that hash to the Pwned Passwords range API, and receives several hundred hash suffixes that share that prefix. The match is made on your device. Neither Have I Been Pwned nor PassCheck learns the password or the full hash.

What is Pwned Passwords?

Pwned Passwords is a free service run by Troy Hunt as part of Have I Been Pwned. It holds hundreds of millions of real passwords exposed in data breaches, with a count of how often each appeared. NIST SP 800-63B tells services to reject new passwords found in lists like this.

My password was found. What should I do?

Stop using it everywhere. Change it first on any account where you reused it, starting with email, banking and anything that can reset other accounts. Use a password manager so each site gets its own random password, and turn on multi-factor authentication where offered.

My password was not found. Is it safe?

Not necessarily. "Not found" only means this exact string is not in the breach corpus. A short or predictable password can be absent and still be cracked quickly. Check its strength with the main checker too.

Is this the same as checking whether my email was in a breach?

No. This page checks a password against leaked passwords. To see which breaches included your email address, use the search on haveibeenpwned.com itself.

What does "padding" mean in the request?

We ask the API to pad its response with fake entries, so the size of the reply does not hint at which prefix you queried. Padded entries have a count of zero and are ignored.