Pwned Password Checker
Check passwords against 800M+ breached credentials without ever transmitting the password.
Check if your password leaked in breaches — privately. Free pwned-password checker using k-anonymity so the password never leaves your browser.
Calculator Inputs
About Pwned Check
Check passwords against 800M+ breached credentials without ever transmitting the password.
Type a password to hash it locally with SHA-1, then send only the first 5 hex characters to the breach database. It returns every matching suffix — your browser compares locally, so the full hash and password never leave the device.
A hit means attackers hold this exact password: change it everywhere it was reused, starting with email. A miss means unseen, not strong — pair with a strength check. Needs HTTPS and connectivity.
Where it is used
Auditing your own passwords, enforcing breach-aware policies, and teaching why reuse kills.
How to use the Pwned Check
- Password To Check — enter the value (e.g. ••••••••).
- Calculate — press the Calculate button to see the result instantly above.
Formula
SHA-1 locally; only the first 5 hash chars leave the browser (k-anonymity range query).
Examples
Example
Frequently Asked Questions
- Is it safe to type my real password?
- Yes by design: k-anonymity means the service only ever sees 5 hash characters (about a million candidates). Still prefer checking passwords you are about to change.
- Not found — am I safe?
- From known breaches, yes. It says nothing about strength: "P@ssw0rd!"-style patterns fall to rules-based attacks regardless.
- Why SHA-1 and not something stronger?
- The breach corpus is indexed by SHA-1. Strength here comes from the protocol (partial disclosure), not the hash.