Has my password been leaked?
Check if your password appeared in known data breaches, without exposing it.
Type your password and we will tell you if it appears in the big public breach databases. Your key never leaves your device.
By VOV · Last updated: October 21, 2026
How does it work? The SHA-1 hash is computed in your browser and only its first 5 characters are sent (k-anonymity): your password never travels the internet.
How it works
How it works: we compute the SHA-1 hash in your browser and only send its first 5 characters to the Have I Been Pwned API (k-anonymity technique): the server returns matching suffixes and the final comparison happens locally. Your password never travels the internet.
Frequently asked questions
Is my password really not sent?
Really: only 5 characters of its SHA-1 hash travel, insufficient to reconstruct it. It is the industry-recommended k-anonymity method.
What do I do if it was leaked?
Change it now everywhere you use it, enable two-factor authentication and consider a password manager.
What is Have I Been Pwned?
The reference service created by Troy Hunt aggregating billions of publicly leaked credentials.