Free tool

Has this password leaked?

Hundreds of millions of passwords circulate in lists stolen from hacked sites. Check whether yours is one of them, without it ever leaving your computer.

🔒 Your password never leaves this browser: only 5 characters of its fingerprint are sent. Nothing is stored.

How it stays secret

  1. Your browser computes a fingerprintThe SHA-1 fingerprint of password123 is CBFDAC6008F9CAB4083784CBD1874F76618D2A97. You can't go back from it to the password.
  2. Only the first 5 characters leaveWe receive CBFDA and ask Have I Been Pwned for every leaked fingerprint that starts that way: several hundred of them.
  3. Your browser comparesThe list comes back and your browser looks for the rest of the fingerprint in it. Neither we nor Have I Been Pwned know which one it was.

This method is called k-anonymity. It is the one password managers and browsers use for the same check.

If it has leaked

Change it everywhere you use it, starting with your email: whoever controls your inbox can reset all your other passwords. Then use a password manager (Bitwarden, 1Password, the one built into your browser) so each site has its own, and turn on two-step verification wherever it is offered.

Frequently asked questions

Has my password been leaked?

Type it in: the tool checks whether it appears in the lists of passwords stolen from hacked sites, using Have I Been Pwned. Your password never leaves your computer.

How does the check keep my password secret?

Your browser computes a fingerprint and sends only its first 5 characters. It then does the comparison itself on the list it gets back, so neither we nor Have I Been Pwned know which password it was.

What should I do if my password has leaked?

Change it everywhere you use it, starting with your email. A password manager then gives each site its own password, and two-step verification adds protection.