Hundreds of millions of real passwords have leaked in data breaches, and attackers try them first on every site. This tool checks a password against the Have I Been Pwned database without revealing it: your browser turns it into a SHA-1 hash, sends only the first 5 of its 40 characters, receives every leaked hash that starts the same way, and looks for a match on your own device.
loading toolHow to check if a password was leaked
- Type the password you want to check.
- Press Check for leaks.
- If it was leaked, change it everywhere you use it.
Good to know
- A password manager can check all your saved passwords for leaks automatically.
- Leaked passwords are dangerous even if they look strong.
Questions
What exactly is sent?
Only the first 5 characters of the password’s SHA-1 hash (for example 5BAA6). Hundreds of different leaked passwords share those 5 characters, and padding is added to the answer, so nobody, not even the database, can tell which password you checked or whether it was found.
It says my password was leaked. What now?
Change it everywhere you used it, starting with email and banking, and turn on two-step verification. The leak may have come from any site, not necessarily yours.
It was not found. Is it safe?
It is not in known breaches, which is good, but it can still be weak or guessable. Check its strength too, and use a different password for every account.
Who runs the database?
Have I Been Pwned is a free public service by security researcher Troy Hunt, used by password managers and governments around the world.
Is it free?
Completely free, with no sign-up, no watermark and no limit on how many times you use it. Light ads keep the site running.
