Pwned Password Checker
Use this free Pwned Password Checker to quickly get accurate results in seconds, free and instantly offline with no signup required ever, trusted by professionals in Austin, Chicago, Miami, Denver, Seattle, and New York for reliable daily use without accounts, subscriptions, limits, or delays on any device for everyday personal and business workflows daily.
Check passwords with this pwned password checker, using k-anonymity to test breached password hashes without sending your password.
Calculator Inputs
About Pwned Check
Use this free Pwned Password Checker to quickly get accurate results in seconds, free and instantly offline with no signup required ever, trusted by professionals in Austin, Chicago, Miami, Denver, Seattle, and New York for reliable daily use without accounts, subscriptions, limits, or delays on any device for everyday personal and business workflows daily.
Hash SHA-1 locally, send 5 chars only. Service returns suffixes, browser compares — full password never leaves.
Hit = attackers hold it: change everywhere, email first. Miss = unseen, not strong — pair strength check. Needs HTTPS.
USA: password123 seen millions. Use manager + 16-char unique.
Safety: K-anonymity 1M candidates per prefix. Prefer checking before change.
Limits: Corpus only, not strength. SHA-1 for index, not security.
k-anonymity mechanics: SHA-1 locally, send 5 chars, compare 1M-candidate suffixes in browser — full secrets never travel. Austin shoppers auditing $5,000 purchase histories check safely on 09/22/2026.
Hit response: Pwned means attackers hold it — rotate everywhere, email first, then banks. Chicago IT enforcing $2M policies mandates checks at every reset.
Miss meaning: Unseen in breaches, not strong — patterns still fall to rule attacks. Miami students fixing dorm logins graduate to managers regardless.
Manager migration: Seattle devs teaching $400,000 client teams deploy managers plus 16-char unique secrets per site. Denver families cleaning $300 shared logins start with email and banking.
Corpus scope: Billions of real breach records — absence proves nothing about phishing or keyloggers, so layer defenses.
Where it is used
Shoppers auditing reused Amazon passwords, IT enforcing breach policies, students fixing password123, families cleaning shared Netflix creds, and devs teaching reuse risk Austin shoppers audit $5,000 Amazon histories, Chicago IT enforces $2M breach policies, Miami students fix dorm logins, Denver families clean $300 streaming shares, Seattle devs teach $400,000 client teams, and New York banks rotate $9M vault creds.
How to use the Pwned Check
- Password To Check — enter the value (e.g. ••••••••).
- Calculate — press the Calculate button to see the result instantly above.
Formula
SHA-1 locally → send first 5 hex only → match suffix list locally → count breaches.
Examples
Common leak
Unique pass
Reuse audit
Frequently Asked Questions
- Is it safe to type my real password?
- Yes by design: k-anonymity means the service only ever sees 5 hash characters (about a million candidates). Still prefer checking passwords you are about to change.
- Not found — am I safe?
- From known breaches, yes. It says nothing about strength: "P@ssw0rd!"-style patterns fall to rules-based attacks regardless.
- Why SHA-1 and not something stronger?
- The breach corpus is indexed by SHA-1. Strength here comes from the protocol (partial disclosure), not the hash.
- Check old passwords?
- Yes — audit retired secrets to learn patterns, but prioritize rotating live credentials first.
- Work offline?
- No — suffix lookup needs HTTPS to the corpus API. Hashing stays local; only 5 chars travel.
- Business enforcement?
- Gate resets and new-hire onboarding through checks. Pair with MFA mandates for real posture.