Leaked Password Checker
Check if a Password Has Leaked in a Data Breach
Need to use Leaked Password Checker right now?
Checks whether a specific password has already appeared in a documented data breach — and shows exactly how many times, since some passwords have leaked millions of times over.
Uses the Have I Been Pwned k-anonymity API: only the first 5 characters of your password's SHA-1 hash are ever sent — never the password itself, and never the full hash.
Features
- Privacy-first processing with automatic deletion
- Real-time, instant results
- 100% free, no sign-up required
- Works on desktop, tablet, and mobile
- No installation needed
Who uses this tool?
About Leaked Password Checker
This tool checks passwords, not email addresses, against Have I Been Pwned's Pwned Passwords database of over 800 million passwords found in real data breaches. Checking whether a specific email address has been breached requires HIBP's paid API, but their password-checking API remains genuinely free and open to everyone — and arguably more actionable anyway, since it tells you directly whether a password you're considering is already known to attackers.
The check uses a clever privacy technique called k-anonymity: your password is hashed with SHA-1 entirely in your browser, and only the first 5 characters of that hash are sent to Have I Been Pwned's API. The service returns every breached password hash that starts with those same 5 characters (typically several hundred), and the actual matching happens locally in your browser — meaning your real password, and even its full hash, is never transmitted anywhere.
A password appearing in this database means it has been exposed in at least one real, documented data breach and is now part of lists attackers actively use for credential-stuffing attacks (trying leaked passwords against other accounts). Even a password that feels unique to you may well be in this database, since many people independently choose the same common passwords.
This is useful for checking a password before using it on a new account, auditing existing passwords for known exposure, understanding why a security team might flag a password as compromised even though it was never directly hacked from your own account, and general password hygiene.
How it works
- Type a password. It's hashed locally in your browser — never sent in plain text.
- Only a hash prefix is checked. The first 5 characters of the SHA-1 hash are sent; the rest stays local.
- See the result. Whether the password appears in known breaches, and how many times.
Examples
Checking a common weak password
Input
"password"
Output
Found in 52,372,427 known data breaches — do not use this password