🔍 Have I Been Pwned?

Check if a password appears in known data breaches — without revealing it.

Enter a password to check

🛡️

Not Found in Breaches

This password has not appeared in any known data breaches in the Have I Been Pwned database.

⚠️

This password has been found times in known data breaches.

You should change this password immediately.

Your password is never sent to any server. Here's the process:

Your password is hashed with SHA-1 locally in your browser.
Only the first 5 characters of the hash are sent to the Have I Been Pwned API.
The API returns all hash suffixes matching that prefix (~500-800 results).
Your browser checks locally if the full hash appears in the results.
The API operator never sees your password or its full hash.