Home › Security
Type a password to check it against 800M+ breached passwords. Privacy first: only the first 5 characters of your password’s hash leave this page — the full password never does.
How it works (k-anonymity): your browser hashes the password with SHA-1, sends only the first 5 hash characters to the breach database, and compares the rest locally. The database never sees enough to reconstruct your password.
Your password is hashed with SHA-1 in your browser. Only the first 5 characters of the hash are sent to the public breach database (800M+ breached passwords); the database returns every hash starting with those characters, and your browser checks the rest locally. This is k-anonymity — the server learns nothing useful about your password. What you will see: either “Seen N times” — change that password everywhere you used it — or “Not found” (no breach record; still use a unique password per site).
Yes — it never leaves your browser. Only 5 characters of its irreversible SHA-1 hash are transmitted, which cannot be turned back into your password.
Change it everywhere you used it, starting with email and banking. Switch on two-factor authentication and use a password manager so every site gets a unique password.
Length beats complexity: four random words is stronger than one tricky word with symbols. Unique per site matters more than anything.