Free tool

Has this password leaked?

Hundreds of millions of passwords circulate in lists stolen from hacked sites. Check whether yours is one of them, without it ever leaving your computer.

🔒 Your password never leaves this browser: only 5 characters of its fingerprint are sent. Nothing is stored.

How it stays secret

  1. Your browser computes a fingerprintThe SHA-1 fingerprint of password123 is CBFDAC6008F9CAB4083784CBD1874F76618D2A97. You can't go back from it to the password.
  2. Only the first 5 characters leaveWe receive CBFDA and ask Have I Been Pwned for every leaked fingerprint that starts that way: several hundred of them.
  3. Your browser comparesThe list comes back and your browser looks for the rest of the fingerprint in it. Neither we nor Have I Been Pwned know which one it was.

This method is called k-anonymity. It is the one password managers and browsers use for the same check.

If it has leaked

Change it everywhere you use it, starting with your email: whoever controls your inbox can reset all your other passwords. Then use a password manager (Bitwarden, 1Password, the one built into your browser) so each site has its own, and turn on two-step verification wherever it is offered.