How to use the Password Breach Checker
- Type or paste the password you want to check. It stays in this page.
- Click Check. Your browser computes the SHA-1 hash and sends only its first 5 characters to Have I Been Pwned.
- The service returns every leaked hash with that prefix; your browser looks for a full match locally.
- If it was found, stop using that password everywhere and switch to a unique one from a password manager.
How it checks without sending your password
This uses the k-anonymity model of Have I Been Pwned’s Pwned Passwords service. Your browser hashes the password with SHA-1 (for example 5BAA6… for “password”) and requests /range/5BAA6. The service answers with all ~800 leaked hashes that start with those 5 characters, and the browser checks for yours. Nobody — not devpack, not the service — learns your password or even its full hash. Requests are padded so the response size reveals nothing.
What the result means
- Found: the password is in breach lists that attackers use for “credential stuffing”. Change it on every site where you used it, even if it looks strong.
- Not found: it isn’t in known breaches. That doesn’t make it strong — short or guessable passwords can still be cracked. Check it with the Password Strength Checker.
Good password habits
Use a different password for every site (a password manager makes this easy), turn on two-factor authentication, and generate long random passwords with the Password Generator.
Data: Pwned Passwords by Troy Hunt, CC BY 4.0.
Also searched as: has my password been leaked, pwned passwords, check password leak, password data breach check, haveibeenpwned password, is my password compromised, leaked password check.
Tools that pair well with the Password Breach Checker
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- TOTP Generator — Paste a Base32 secret to see the current 6-digit 2FA code with a live countdown — exactly what Google Authenticator, Authy or 1Password would show.
- Bcrypt Generator & Checker — Create bcrypt hashes for test users, seed data or config files, and check whether a password matches a stored hash — without sending either anywhere.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.