Password Breach Checker

🔐 What a breach checker actually does

A breach checker answers one question: has this exact password appeared in a public data breach? It does not tell you whether your account is currently at risk, whether your email appears in a leak, or whether someone is trying to log in. It only compares your password against a database of passwords that have been exposed in past breaches.

That distinction matters, because people often confuse two different tools. Have I Been Pwned has both a password checker (what this page uses) and an email checker. The email checker tells you which breaches have included your address. The password checker tells you whether a specific password is on a public list. They solve different problems, and both are useful.

This tool focuses on the password side. If a password you use is on any public breach list, attackers will try it against your accounts. The check takes under a second, and the result is definitive — either the password is in the list, or it is not.

🛡️ The k-anonymity model, explained simply

The obvious way to check a password against a database is to send the password to the server and ask "is this one in your list?" But that would mean handing your password to a stranger, which defeats the point.

The clever way is k-anonymity. Here is how it works in five steps:

1. Hash the password. Your browser computes the SHA-1 hash of the password. For "password123", that hash is CBFDAC6008F9CAB4083784CBD1874F76618D2A97.
2. Split the hash in two. Take the first 5 characters (CBFDA) and call it the prefix. The remaining 35 characters (C6008F9CAB4083784CBD1874F76618D2A97) are the suffix.
3. Send only the prefix. Your browser sends CBFDA to the HIBP API. This is the only piece of information that leaves your device.
4. Receive all matching hashes. The API returns every hash in its database that begins with CBFDA. This is roughly 800 hashes — every password that happens to share those 5 leading characters.
5. Match locally. Your browser checks whether your full hash (prefix + suffix) is in that list. If it is, the password has been breached. The server never learned which of the 800 hashes was yours.

Because roughly 800 passwords share any given 5-character prefix, the server cannot tell which password you were checking. Your privacy is mathematically protected, not just promised.

🧪 Reading the strength meter

The breach check tells you whether a password is on a public list. The strength meter tells you how hard that password would be to crack even if it is not on any list yet. Both matter.

Entropy, measured in bits

Entropy is the number of bits of randomness in a password. It is calculated from two things: the size of the character set you used, and the length of the password. A password made from lowercase letters and digits (36 possible characters) that is 8 characters long has roughly 8 × log₂(36) ≈ 41 bits of entropy. Add uppercase and symbols and the character set grows to 95, pushing the same 8 characters to 8 × log₂(95) ≈ 52 bits.

The doubling rule applies: every additional bit of entropy doubles the number of guesses an attacker needs. Going from 40 bits to 80 bits does not double the effort — it multiplies it by roughly a trillion.

Rough crack-time estimates

The meter also estimates how long a modern cracking rig would take to guess the password. This assumes a rig that can try 10 billion guesses per second, which is realistic for a GPU cluster against fast hashes like MD5 or SHA-1. Against properly hashed passwords (bcrypt, Argon2), the real-world speed is thousands of times slower.

The estimates are order-of-magnitude, not precise. They assume the attacker is not targeting you specifically, uses an efficient guessing strategy, and has hardware you can rent for a few hundred dollars an hour. For most purposes, they are good enough to tell the difference between "this is fine" and "this is not fine".

⚡ What to do when a password shows as breached

Finding out a password has been breached is stressful, but the fix is straightforward:

1. Change it everywhere you used it

Attackers compile breach lists and try the same password against other services. This is called credential stuffing, and it succeeds because people reuse passwords. If your breached password is used on more than one site, change it on all of them. Start with email accounts and anything financial.

2. Change it to something unique and strong

Do not change "Password123" to "Password456". Do not change "Summer2025" to "Summer2026". Use a completely new password, generated with a password manager or the generator on this page. Aim for at least 16 characters and include a mix of character types.

3. Enable two-factor authentication

Even if your new password leaks tomorrow, a second factor stops most attacks. Turn on 2FA for email, banking, social media, and anything with your payment details. Authenticator apps are more secure than SMS codes, but SMS is still far better than nothing.

4. Check your email addresses too

Visit haveibeenpwned.com and check every email address you own. It tells you which breaches have included that address, along with the dates and the types of data exposed. If a breach involved more than just passwords (payment cards, addresses, ID numbers), you may need to take additional action.

5. Watch for account recovery changes

After a breach is public, attackers sometimes try to reset passwords or change recovery emails on high-value accounts. If you get a password reset email you did not request, treat it as a warning sign. Log in directly and check that the recovery email and phone number are still yours.

📚 Password managers worth using

The only realistic way to have a different password on every site is to let software remember them for you. Here are the mainstream options and who each is best for.

Bitwarden is what most security professionals recommend to friends and family. It is free, open source, audited, and available on every platform. The paid tier is $10 per year and adds encrypted file storage and a hardware security key option.

🔒 Your privacy and how we handle data

Your password never leaves your browser. When you click Check, your password is hashed with SHA-1 using the Web Crypto API. Only the first five characters of the resulting 40-character hash are sent to the HIBP Pwned Passwords API over HTTPS. The API returns around 800 candidate hashes that share that prefix; your browser checks locally which one matches. The plaintext and the full hash are never transmitted.

History is local only. The History tab stores your last 30 checks in your browser's localStorage. Each entry holds only the 5-character prefix, the breach count, and a timestamp — never the full hash, never the password. You can clear the entire history at any time with the "Clear all history" button.

No servers of ours are involved. The check is a direct browser-to-HIBP request. We do not proxy it, log it, or see it. If HIBP is unreachable, the tool shows an error and does nothing else.

Cookies and advertising. Advertising and analytics cookies are switched off by default. They only turn on if you press Accept all, or select them individually under Manage preferences. You can change your choice at any time from the Cookie Policy page. Full details are in our Privacy Policy.

About the author

❓ Frequently asked questions

Related tools