How to use it
- Type the password in Password. It is hidden; press Show to read what you typed.
- Press Check. The page hashes the password in your browser and sends only the first five characters of the hash.
- Read the Result: Found with a count means the password appears in breach data; Not found means it is not in this list.
- If it was found, change it everywhere you used it. To test a new one, use the Password strength checker.
What is sent and what is not
The password is hashed with SHA-1 in your browser. A hash is a fixed string of 40 hexadecimal characters, such as 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8 for the password password, and it cannot be turned back into the password. The page sends only the first five characters of the hash, for example 5BAA6, in one request to the range address of the Pwned Passwords service.
The service answers with every known breached hash that starts with those five characters. The rest of your hash is then looked for in that answer, in your browser. Many different passwords share the same five characters, so the service cannot tell which password was checked. This is the k-anonymity method the service describes.
- Sent: the five characters of the hash, and the header Add-Padding, which asks the service to pad its answer with empty entries so that the size of the answer does not show how many hashes matched. As with any web request, the service sees the address of your connection.
- Not sent: the password, the full hash, the rest of the hash, or the password's length. The request carries no cookies and no referrer.
- Not stored: the page keeps nothing. Reloading it forgets the password and the result.
What the result means
Found means the password appears in data that leaked in a past breach. The number is how many times it appears in the list. Attackers try such passwords against accounts, so change it wherever you used it.
Not found means only that the password is not in this list. It does not show that the password is strong, and it does not cover leaks the list lacks. Check its strength too, with the Password strength checker.
Worked example: password
The SHA-1 hash of password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. The page sends only the first five characters, 5BAA6, and looks for the other 35 characters, 1E4C9B93F3F0682250B6CF8331B7EE68FD8, in the answer. If that suffix is listed with a count above 0, the result is Found with that count; if it is not listed, the result is Not found.
Frequently asked questions
Is my password sent to the service?
No. Only the first five characters of its SHA-1 hash are sent. The service cannot work the password out from them, and the rest of the hash is compared in your browser.
Why does the service send back many hashes?
It returns every breached hash that starts with the same five characters, so it cannot tell which one you were checking. This is the k-anonymity method, and it lets the check run without giving the password away.
What should I do when the result is Found?
Treat the password as exposed. Change it on every site where you used it, and do not reuse it. Turn on two-factor sign-in where the site offers it.
Does Not found mean the password is safe?
No. The list holds only passwords seen in the breaches it covers, so a weak password can still be absent from it. Check its strength too, because a short or common pattern is weak even before it leaks.
Does the page store or log what I type?
No. The password stays in the field and in the page's memory while the page is open. Nothing is stored in the browser or written into the address, and the page makes no other request.
Which service does the check use?
The Pwned Passwords range service of Have I Been Pwned, documented at haveibeenpwned.com. The page calls its range address directly from your browser.
Sources
- Have I Been Pwned: Pwned Passwords API (v3)
- NIST SP 800-63B: compare passwords with lists of compromised values
Figures and text last checked on Tuesday, November 10, 2026.