How to check if your password was leaked

You can find out whether a password has appeared in a data breach without revealing the password to anyone.

Check now

Open the strength checker, type the password and press "Check against known breaches". The answer is a count of how many times it appears in breach data, or not found.

How it works without sending your password

Have I Been Pwned keeps a corpus of passwords exposed in real breaches, stored as SHA-1 hashes. Its range API uses k-anonymity:

Your browser computes the SHA-1 hash of the password, a 40 character string.
It sends only the first 5 characters of that hash to the API.
The API returns every hash in its corpus that starts with those 5 characters, typically several hundred, each with a count.
Your browser looks for the rest of your hash in that list.

The service sees only a prefix shared by hundreds of unrelated passwords, so it cannot tell which one you checked. This site also asks for padded responses, which adds dummy entries so the response size gives nothing away.

If your password was found

Stop using it everywhere it is used, starting with email, because email resets every other account.
Replace each one with a unique password from the generator, stored in a password manager.
Turn on a second factor on important accounts.
If you had reused it, check those accounts for logins you do not recognise.

Not found is good news, but it does not mean strong. A short or predictable password can be guessed whether or not it has leaked.

Why sites should do this too

NIST SP 800-63B-4 requires systems to compare new passwords against a list of commonly used, expected or compromised values when they are set. Many sites now run this exact check at signup.

Published 18 October 2026. Last reviewed 18 October 2026.

Questions

Is the Have I Been Pwned password check safe?

Yes, when done through the range API as here. The full password and full hash never leave your device.

Does this check my email address too?

No. This checks a password only. To see which breaches included your email address, use the search on haveibeenpwned.com.

Sources

Pwned Passwords API documentation, Have I Been Pwned. Checked 18 October 2026.
Validating Leaked Passwords with k-Anonymity, Cloudflare. Checked 18 October 2026.
SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.

Related tools and guides

Strength checkerTest a password and check it against known breaches.Password generatorFree password generator that runs in your browser. Strong, random passwords and passphrases made with the Web Crypto API. Nothing is sent or stored.NIST password rules (2025)What SP 800-63B-4 changed and what it means for you.Passphrase generatorRandom words you can remember and type.