Check any password against billions of credentials exposed in public data breaches. It runs in your browser, and the password never reaches our servers.
Your password is hashed inside this page. Only the first five characters of that hash are ever sent anywhere — never the password, and never the full hash. How this works.
Most "breach checkers" ask you to send them your password. This one does not, and here is exactly why it does not need to.
Your browser computes a SHA-1 hash of the password locally, using the built-in Web Crypto API. The password itself never leaves the page — it is not sent to Comptrusence, and it is never stored.
We send just the first five characters of that hash to the Have I Been Pwned range API. That prefix is shared by many thousands of different passwords, so it identifies nothing on its own.
The API returns every leaked hash starting with that prefix. Your browser looks for yours in that list. The service never learns which one you asked about.
A match means this exact password appears in a breach corpus somewhere — not that your account was breached. It matters because attackers feed these lists straight into credential-stuffing tools. A password on that list is effectively public, however strong it looks.
No match is not a clean bill of health either. It only means the password is not in this corpus. Length and uniqueness still matter more than anything else.
Members can look up whether an email address appears in known breaches, scan a website for vulnerabilities, and check TLS, DNS and email spoofing posture.
Create a free account See all tools