Password leak check
Find out whether a password has appeared in a known data breach. We never see the password and nothing is stored.
Check a password
Result
Your password stays private
This check uses a method called k-anonymity, so we never see or store the password you type.
- Your browser turns the password into a one-way fingerprint (a SHA-1 hash). The fingerprint cannot be turned back into the password.
- Only the first five characters of that fingerprint are sent. Hundreds of different passwords share those five characters.
- The breach database sends back every fingerprint that starts the same way, and your browser looks for a match on this device.
We do not check email addresses or accounts.
What the result means
- Found: the password is public knowledge to attackers. Never use it, and change it everywhere you have used it.
- Not found: it is not in the known breach data. That does not make it strong or safe. Check its strength as well.