About this tool
Verify whether a password has appeared in historical data breaches using mathematical k-anonymity. Your password is hashed with SHA-1 on your device and never sent across the network.
Pwned Password Leak Checker
Check if your password was exposed in public data breaches using 100% private client-side k-anonymity SHA-1 hashing.
Example
- password: password123
Output
EXPLOREWaiting
Run the tool to generate output.
Live data provided byHave I Been Pwned(Free Open Security Service).Permitted for commercial and personal applications.
When to use this tool
Use Pwned Password Leak Checker before adopting a new password or when auditing company credential policies.
Inputs, Formats & Specifications
- Accepted Inputs
- Password text string
- Output Formats
- Breach status (Clean or Compromised), exact breach occurrence count, SHA-1 prefix disclosure
- Supported Standards
- UTF-8 string, SHA-1 160-bit hash, k-Anonymity API (v3)
- Browser Limits & Scope
- Checks presence in known, cataloged public data breaches; zero breach records does not guarantee a password cannot be guessed if it is too short.
How to use this tool
- Type or paste a prospective password into the secure password search field.
- The tool calculates the SHA-1 hash of your password locally in your browser.
- Only the first 5 characters of the hash prefix are queried against the Have I Been Pwned API.
- The browser inspects the returned hash suffixes locally to tell you if the password was leaked, and how many times.
Examples
Compromised Password Verification
Check common passwords like 'password123' to observe that it has appeared in over 3 million data breaches, confirming why it must never be used.
New High-Entropy Password Audit
Verify that a freshly generated 16-character password has zero occurrences in global breach databases.