Has my password been leaked?
Check a password against hundreds of millions of leaked passwords without sending it anywhere.
Password strength checker
Checked as you type, on this device. It isn't saved and is cleared when you leave.
Has this password leaked?
Tap Check to look it up in Have I Been Pwned's list of hundreds of millions of leaked passwords. Only the first 5 characters of its SHA-1 hash are sent, never the password.
Generator
Made on this device with your browser's secure random generator. Never saved, never sent, no history.
Options
Site rules PRO
Make a list PRO
Five rules for strong passwords
- Length beats tricks.Four or more random words, or 16+ random characters. Swapping a for @ adds almost nothing.
- One password per site.Reuse is how one leak opens every account.
- Let a password manager remember them.Your phone or browser has one built in.
- Turn on two-step sign-in.Use a passkey or an authenticator app where you can.
- Skip names, dates and patterns.Birthdays, pets, teams and qwerty are tried first.
Settings
What it does
Type the password, then tap Check under "Has this password leaked?". Your browser turns it into a SHA-1 hash, a 40-character fingerprint, and sends only the first 5 characters to Have I Been Pwned's Pwned Passwords service. The service replies with every leaked hash that starts with those 5 characters, several hundred of them, and your browser looks for a match itself.
This is called k-anonymity: the service never sees your password or even its full hash, so it can't tell which of the hundreds of matches you were checking. The request also asks for padding, extra dummy rows, so the size of the reply gives nothing away. Nothing is sent until you tap Check.
How to use it
- Type the password in the checker.
- Tap Check (or press Enter).
- Found? Change it everywhere you used it, starting with email and banking.
Passwords are made on this device and are never saved, sent or kept in a history. Only your settings are remembered.
Good for
- Checking a password you have used for years
- After you hear about a breach at a site you use
- Before reusing an old password (better: don't reuse)
- Showing someone why reused passwords are risky
Questions
Is it safe to check my password here?
Yes. Only the first 5 characters of its SHA-1 hash are sent, and only when you tap Check. The match is made on your device, and nothing is saved.
My password was found. What should I do?
Stop using it. Change it on every site where you used it, give each site its own random password, and turn on two-step sign-in where you can.
It wasn't found. Is it safe?
It isn't in any known leak, which is good, but it can still be weak or guessable. Check its strength above and use it for one site only.
More generators and checks
Open the full Password Generator · Guide: How to create a strong password