Password Breach Check

Learn about breach checking

How this stays private while checking a breach database

This uses a technique called k-anonymity. Your password is hashed locally in your browser with SHA-1, and only the first 5 characters of that hash are sent to Have I Been Pwned. The service sends back every hash suffix on record that starts with those 5 characters, usually hundreds of them, and the actual match against your full hash happens locally in your browser. Have I Been Pwned never sees your real password, or even the full hash of it.

Reading your results

A match means that exact password has shown up in at least one known breach dataset, not necessarily one tied to you personally, since breach data gets recirculated and recombined constantly across the internet. A result of zero means it hasn't appeared in anything Have I Been Pwned has indexed so far, which isn't the same as a guarantee that it's strong.

Common questions

My password was found. Does that mean my account was hacked? Not necessarily that specific account. It means that password string exists somewhere in the breach corpus, possibly from an entirely different service you used it on. Either way, once a password shows up in a breach dataset it should be treated as compromised and retired.

Is a password with zero breach hits automatically safe? No. This only checks whether attackers already know it. A short or predictable password can still be guessed or brute-forced even if it's never appeared in a breach before.

Why SHA-1 for the anonymity step, when it's considered a weak hash? That's simply the format Have I Been Pwned's API defined for this range-query system. It's used only as an identifier for the lookup itself, not as protection for your password, so SHA-1's known weaknesses as a hashing algorithm don't undermine the privacy model here.