Cómo usar: Password Breach Checker
- Type or paste the password you want to check. It stays in this page.
- Click Check. Your browser computes the SHA-1 hash and sends only its first 5 characters to Have I Been Pwned.
- The service returns every leaked hash with that prefix; your browser looks for a full match locally.
- If it was found, stop using that password everywhere and switch to a unique one from a password manager.
How it checks without sending your password
This uses the k-anonymity model of Have I Been Pwned’s Pwned Passwords service. Your browser hashes the password with SHA-1 (for example 5BAA6… for “password”) and requests /range/5BAA6. The service answers with all ~800 leaked hashes that start with those 5 characters, and the browser checks for yours. Nobody — not devpack, not the service — learns your password or even its full hash. Requests are padded so the response size reveals nothing.
What the result means
- Found: the password is in breach lists that attackers use for “credential stuffing”. Change it on every site where you used it, even if it looks strong.
- Not found: it isn’t in known breaches. That doesn’t make it strong — short or guessable passwords can still be cracked. Check it with the Password Strength Checker.
Good password habits
Use a different password for every site (a password manager makes this easy), turn on two-factor authentication, and generate long random passwords with the Password Generator.
Data: Pwned Passwords by Troy Hunt, CC BY 4.0.
También se busca como: has my password been leaked, pwned passwords, check password leak, password data breach check, haveibeenpwned password, is my password compromised, leaked password check.
Herramientas que combinan con: Password Breach Checker
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- TOTP Generator — Paste a Base32 secret to see the current 6-digit 2FA code with a live countdown — exactly what Google Authenticator, Authy or 1Password would show.
- Bcrypt Generator & Checker — Create bcrypt hashes for test users, seed data or config files, and check whether a password matches a stored hash — without sending either anywhere.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.