How it works
This tool checks whether a password appears in Have I Been Pwned's database of breached credentials. It hashes the password with SHA-1 in your browser and sends only the first five characters of that hash to the API. The service returns every matching hash suffix and your browser finds the match locally — the password, and even its full hash, never leave your device. This technique is called k-anonymity.
If a password shows up here, stop using it everywhere: breached passwords are the first thing attackers try. A password not in the database still isn't safe if it's short or predictable — use the strength checker and a password manager.
What to do if your password was found
A match means this exact password is already in attackers' lists. Act now:
- Change it everywhere you used it, from a device you trust, in this order: email first (it can reset everything else), then banking and anything with a saved card, then social accounts.
- If you reused it, treat every account that had this password as compromised — not just the one that leaked.
- Set a unique generated password per site and turn on two-factor authentication (an authenticator app or hardware key, not SMS).
- Search your email address on Have I Been Pwned too — a breach usually exposes more than the password.
- Expect phishing in the following weeks: attackers now hold your email and an old password and will use them as bait. Never act on an unexpected “security alert” link.
A password that was not found still isn't safe if it is short or predictable — length and randomness are what protect it.
Generated a strong password? You need somewhere safe to keep it →
Related terms: Credential stuffing · Data breach · Hash · Salt (salting) · Password manager