Free tool
Breached password checker
See if a password has turned up in a data breach. Only the first five characters of its SHA-1 hash leave your browser, never the password.
How it works
Checked without sending the password
- Hash it here
- Your browser runs the password through SHA-1. password becomes 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
- Send five characters
- Only 5BAA6 goes to Have I Been Pwned. There are about a million possible five-character prefixes, and each is shared by hundreds of breached passwords.
- Get the whole bucket back
- The service returns every hash ending that starts with those five characters, with a count for each. Padding adds dummy rows, so even the reply's size gives nothing away.
- Match it here
- Your browser looks for the other 35 characters in that list. The answer, like the password, stays in the tab.
k-anonymity
Why five characters are safe to send
k-anonymity means your question looks the same as many other people's. When this page asks for 5BAA6, the service learns that you're interested in one of the hundreds of hashes starting with those characters, or in one that isn't on the list at all. It can't narrow it down further, and it never sees the password or the full hash. Have I Been Pwned designed the API this way so that services can check passwords at sign-up without handing them over.
The request goes straight from your browser to api.pwnedpasswords.com, not through our server. The panel beside the tool shows it exactly, with the five characters it will carry, before you press Check. Nothing is sent while you type, and no cookies or referrer go with it.
Results
What a result means
- Found means the password appears in breach data that attackers already use. They try those passwords first, against every kind of login, so stop using it anywhere and change it wherever it's in use.
- The count is how many times it was seen across breaches. A count in the millions means it's one of the first guesses any attacker makes. Even a count of 1 is enough to retire it.
- Not found means it isn't in the data collected so far. It says nothing about strength: check that with the password strength checker.
Checking passwords against breach lists isn't only for individuals. NIST's digital identity guidelines (SP 800-63B) tell services to compare new passwords with lists of compromised ones and reject matches.
Next step
Replace it, then send it safely
Make the replacement with the password generator, and keep it in a password manager. If the new password has to reach someone else, don't paste it into chat or email where it stays in the history. A secure note is encrypted in your browser and can delete itself after one read.
Data
Where the data comes from
Results come from Pwned Passwords by Have I Been Pwned, a free service that collects passwords exposed in earlier data breaches and counts how often each was seen. ProtectedShare isn't affiliated with Have I Been Pwned; this page calls its public range API from your browser.
FAQ
Questions
Is it safe to check my real password here?
The password never leaves your browser. It's hashed with SHA-1 in the tab, and only the first five of the hash's 40 characters are sent. Hundreds of breached passwords share any five characters, so the service can't tell which one, if any, you checked. You can watch the single request in your browser's developer tools.
What should I do if my password was found?
Stop using it. Attackers feed breached passwords into logins everywhere, so change it on every account that uses it, starting with your email, and turn on two-factor sign-in where you can. A hit doesn't always mean one of your accounts leaked: if someone else used the same password, it's on the list too.
My password wasn't found. Is it strong?
Not necessarily. Not found only means it isn't in the breach data collected so far. A short or predictable password can still be guessed quickly. Check it with the password strength checker, and use each password in one place only.
What is k-anonymity?
A way to look something up without saying exactly what. Your browser sends a small part of the password's hash that many other hashes share, gets back all of them, and finds the match itself. The service only learns which group you asked about.
Why SHA-1? Isn't it broken?
SHA-1 is broken for collisions, meaning someone can craft two different inputs with the same hash. That doesn't matter here: the hash is only used to find a bucket in the list. What protects your password is that just five of its 40 hash characters are sent.
Where does the data come from?
From Pwned Passwords, the free service run by Have I Been Pwned. It's a large corpus of passwords exposed in earlier data breaches, with a count of how often each was seen. This page is independent of Have I Been Pwned and simply calls its public API.
Does this check my email address too?
No. It checks passwords only. To see which breaches include your email address, search it on haveibeenpwned.com.