Live · HIBP API

Password Breach
Checker Pro

Instantly verify if your password appeared in known data breaches. Your password never leaves your device — ever.

🔒 k-Anonymity Model
⚡ SHA-1 Local Hashing
✅ Zero Data Transmitted
12B+
Breached Records
700M+
Emails Indexed
<1s
Avg Check Time
100%
Private By Design
Enter password to scan
🔐 Only the first 5 chars of the SHA-1 hash are sent · Your password never leaves this browser
Security Pro-Tips
  • Never reuse passwords across different accounts
  • Change breached passwords on every site immediately
  • Use a password manager — Bitwarden, 1Password, or similar
  • Enable two-factor authentication (2FA) wherever possible
  • Aim for 16+ character unique passphrases
Why Regular Checking Matters
  • Over 80% of hacking-related breaches involve stolen passwords
  • Credentials get resold on dark web markets for years after a breach
  • Credential stuffing attacks try millions of combos per hour
  • Even "strong" passwords can appear in third-party service leaks
  • Check passwords periodically — not just after known breaches
Privacy First, Always. Your password is hashed entirely inside your browser using the Web Crypto API. We apply the HIBP k-anonymity model — only the first 5 hex characters of the hash reach the server. The API returns thousands of possible hash suffixes; we match locally. Your plaintext password and full hash never travel over any network.
Process
How it Works
01
⌨️
You enter a password
Your input stays entirely local — no keystroke logging, no form submissions.
02
🔑
Local SHA-1 hashing
We use the browser's native Web Crypto API to generate a SHA-1 hash of your password.
03
📡
5-char prefix sent
Only the first 5 characters (of 40) are sent to HIBP. This is the k-anonymity model.
04
🔎
Local suffix match
HIBP returns ~1,000 matching suffixes. We match your full hash suffix locally.
FAQ
Common Questions
No. Your password is hashed locally with SHA-1 via the browser's Web Crypto API. Only the first 5 characters of the 40-character hash are ever sent to the HIBP API. The full hash — and certainly the plaintext — never leave your device.
It means this exact password appeared in at least one known public data breach. Attackers compile these into lists used for credential stuffing — trying the password on other services. You should treat it as fully compromised and change it everywhere it was used.
SHA-1 is broken for digital signatures (collision attacks), but HIBP uses it purely for database lookups against a pre-existing index. The k-anonymity model means only 5 of 40 hash characters are transmitted, making interception useless. Do NOT use SHA-1 to store passwords — that requires bcrypt, scrypt, or Argon2.
Yes — each check is fully independent and private. Just clear the field, type a new password, and click Scan. There's no limit.
It means the password doesn't appear in HIBP's breach database — which is a good sign. But "not breached" doesn't mean "strong." A password like "abc123" might not be in HIBP yet but is still trivially guessable. Always use long, random, unique passwords.