Have I Been Pwned? Free Password Breach Checker Online
Check if your password appeared in known data breaches, without exposing it.
Type your password and we will tell you if it appears in the big public breach databases. Your key never leaves your device.
By VOV · Last updated: October 21, 2026
How does it work? The SHA-1 hash is computed in your browser and only its first 5 characters are sent (k-anonymity): your password never travels the internet.
How it works
How it works: we compute the SHA-1 hash in your browser and only send its first 5 characters to the Have I Been Pwned API (k-anonymity technique): the server returns matching suffixes and the final comparison happens locally. Your password never travels the internet.
Use cases
- Verify whether your email appeared in any data breach before continuing to use it the same way
- Check whether the password you've used since 2019 has been exposed in any known hack
- Check whether your company data leaked after someone received a suspicious phishing email at work
Frequently asked questions
Is my password really not sent?
Really: only 5 characters of its SHA-1 hash travel, insufficient to reconstruct it. It is the industry-recommended k-anonymity method.
What do I do if it was leaked?
Change it now everywhere you use it, enable two-factor authentication and consider a password manager.
What is Have I Been Pwned?
The reference service created by Troy Hunt aggregating billions of publicly leaked credentials.