Has my password been leaked?
Type a password. Your browser turns it into a hash and sends only the first five characters, so neither we nor the breach database ever see the password.
What you get
- Whether the password appears in any of the billions of leaked passwords Have I Been Pwned holds, and how many times.
- What to do if it does: change it everywhere it was used, and turn on two-step sign-in.
- A check that runs in your browser: the password and its full hash never leave it.
- Nothing stored, nothing logged.
Common questions
Is it safe to type my password here?
Yes. Your browser hashes it (SHA-1) and sends only the first five characters of that hash. The site relays them to Have I Been Pwned, which returns hundreds of hashes that start the same way, padded with fakes; your browser looks for a match. The password is never sent.
It says not found. Is my password strong?
Not necessarily. It means it is not in a published breach. Use a different password for every account, kept in a password manager, and turn on two-step sign-in.
What about my email address?
Use the email breach check: it shows which breaches an address appears in and what leaked.
Get told when it changes
Add the site to a free account and we check it every five minutes, with certificate, domain and email security alerts in plain English.