Password Breach Check
A password breach check asks one question of a database no chatbot can answer: has this password appeared in a known data breach? Type a password and this page hashes it in your browser, sends only the first 5 characters of the hash to Have I Been Pwned’s Pwned Passwords service, and tells you how many times the password has been seen in real breaches — the password itself never leaves this page. You can also check up to 50 passwords at once, or upload a file of SHA-1 hashes. The companion guide, is your password in a data breach, explains what the count means and what to do next; for a fresh start, use the Password Generator, and to find credentials exposed on a live site, the Leaked Secret Scanner.
Last updated:
Your password never leaves this page
This page hashes your password in your browser with SHA-1 and sends only the first 5 characters of the hash to Have I Been Pwned. The password itself — and even its full hash — never leaves your device, is never stored and is never logged. The service answers with every hash suffix that shares those 5 characters, and the match is done here, on your device. Read how the model works at haveibeenpwned.com/Passwords.
Check one password
Check many at once
Duplicates are checked once. Results show only a number (#1, #2…) — never the password itself. The CSV export contains labels and counts only.
A text file with one 40-character SHA-1 hash per line, up to 500 lines. Lines that are not valid hashes are listed as skipped, never silently dropped. Results show a truncated hash, never the full one.
Or drop the file anywhere in this box. Limit: 2 MB. The file is read on this device only and is never uploaded.
Results
The honest limits
This checks the Pwned Passwords breach corpus only — passwords gathered from hundreds of known data breaches. “Not found” means “not seen in known breaches”, not “safe”.
No email-breach lookup is offered here: Have I Been Pwned’s email breach API is a paid subscription service, so this page does not promise it for free.
Breach data: Have I Been Pwned — Pwned Passwords (haveibeenpwned.com/Passwords).
What a breach corpus is — and what a count means
A breach corpus is a collection of passwords harvested from real data breaches: when a service is breached and its password database leaks, the passwords in it — usually stored as hashes — are gathered, deduplicated and indexed so anyone can ask whether a given password is among them. Have I Been Pwned’s Pwned Passwords corpus holds over a billion such passwords from hundreds of breaches, and it keeps growing as new breaches surface. That scale is the whole point of checking: a password you invented in five seconds has very likely been invented, in exactly the same form, by thousands of other people — and if it was ever in a breached database, attackers already have it on a list, ready to try against every login page they can reach.
The check works without ever revealing the password, thanks to a trick called k-anonymity. Your password is hashed in the browser with SHA-1, producing a 40-character fingerprint; only the first 5 characters of that fingerprint are sent to the service. The service returns every fingerprint suffix that shares those 5 characters — typically around eight hundred of them — and your browser looks for its own suffix in that list, locally. Five characters are enough to hide one password among hundreds of lookalikes, and short enough that the service never learns which password you asked about. The password itself never crosses the network, never touches a server log, and never appears in a URL.
Found, not found — and what to do next
A count above zero means the password has been seen in breaches that many times. A count in the millions — “password” has been seen more than fifty million times — means it is one of the first guesses in every credential-stuffing attack, and it should be changed everywhere it is used, starting with email and banking. A small count is not a pass either: even a single appearance means the password is in an attacker’s wordlist, and it is also probably a sign the password follows a guessable pattern — a name plus a year, a keyboard walk, a common phrase with a digit swapped in. The fix is the same in both cases: replace it with a unique password you have never used anywhere else, generated by the Password Generator and kept in a password manager, not in your head or in a notes file.
A count of zero is good news with a strict limit: the password has not been seen in the breaches this corpus knows about. It says nothing about whether the password is strong, guessable or already sitting in a breach that has not surfaced yet. A short, familiar password can be absent from the corpus and still fall to a guessing attack in minutes, and a password reused across ten sites is one breach away from losing all ten. Treat “not found” as permission to keep a password only if it is also long, random and used in exactly one place. If it fails any of those three tests, change it anyway — the check tells you about exposure, not about strength.
Never paste a password into a chatbot or an AI assistant to ask whether it is safe. A chat keeps a transcript: your password would be stored on someone else’s servers, used to train or tune models, and possibly quoted back in a later answer — the exact opposite of what a breach check is for. The same rule applies to any website that asks you to type a password into its form and promises to judge it: unless the page hashes locally and shows you the mechanism, as this one does, assume the password is being sent and stored. A breach check is worth doing precisely because it can be done without handing the secret to anyone, and that property is worth protecting even when the question feels small.
The check, in plain terms
| k-anonymity | Only the first 5 characters of the password’s hash leave the browser. The service cannot tell which of the hundreds of passwords sharing that prefix you asked about. |
| SHA-1 hash | A 40-character fingerprint of the password, computed in your browser. The same password always produces the same fingerprint, and the fingerprint cannot be reversed into the password. |
| Pwned Passwords corpus | Over a billion passwords gathered from hundreds of known data breaches, maintained by Have I Been Pwned and updated as new breaches surface. |
| Range API | The public, free, keyless HIBP endpoint this page calls: given a 5-character prefix it returns every matching suffix with its breach count, one SUFFIX:count line each. |
| Breach count | How many times the password has been seen in the corpus. A count of 1 already means it is in an attacker’s wordlist; millions means it is among the first guesses tried. |
| Not found | The password’s hash suffix is absent from the returned range — it has not been seen in known breaches. It is not a verdict that the password is strong or safe. |
| Bulk paste | Up to 50 passwords, one per line. Duplicates are checked once, passwords sharing a 5-character prefix share one request, and results show only numbers — never the passwords. |
| Hash file | Up to 500 SHA-1 hashes, one per line, for checking passwords you do not want to type at all. Invalid lines are listed as skipped; results show a truncated hash. |
| CSV export | The bulk results as a spreadsheet: masked label and breach count only. No plaintext password and no full hash ever reaches the downloaded file. |
| Email breaches | Not offered here. Looking up whether an email address appears in breaches needs HIBP’s paid email API, so this page promises no free email lookup. |
Frequently asked questions
Is my password sent to Have I Been Pwned?
No. Your browser hashes the password with SHA-1 and sends only the first 5 characters of the hash. The service returns hundreds of matching suffixes and your browser checks its own suffix locally. The password itself — and even its full hash — never leaves this page, is never stored and never logged.
What does “found 52 million times” mean?
It means that exact password has appeared in breached databases 52 million times, across many different breaches and accounts. It is one of the first guesses in every credential-stuffing attack, where stolen passwords are tried automatically against login pages. Change it everywhere it is used, starting with your email and banking, and never reuse it.
My password was not found. Is it safe now?
Not necessarily. “Not found” means only that it has not been seen in the breaches this corpus knows about. A short or predictable password can be absent from the corpus and still fall to guessing in minutes, and a password reused across sites is one breach away from losing all of them. Keep it only if it is long, random and used in exactly one place.
Why can’t I check an email address here?
Checking whether an email address appears in breaches uses a different HIBP service — the email breach API — which is a paid subscription. This page only uses the free Pwned Passwords range API, which checks passwords, not email addresses, and it would be dishonest to promise the email lookup for free.
My password was found in a breach. What do I do first?
Change it everywhere you use it, starting with the accounts that protect the others — your email first, then banking and password recovery paths — and never reuse the old password anywhere. Generate a fresh, unique replacement with the Password Generator and store it in a password manager. If the same password protected several accounts, treat all of them as exposed, because attackers try a leaked password against every service they can reach.