Breach & password check

Two separate checks: a password check that runs entirely in your browser, and pointers to checking an email address without handing it to us.

Password check

Your password never leaves this browser. This uses the Have I Been Pwned Pwned Passwords k-anonymity API. Your password is hashed with SHA-1 locally, in your browser, using the Web Crypto API. Only the first 5 characters of that hash are sent to the API — never the password, and never the full hash. The API returns every known breached hash sharing that 5-character prefix (often hundreds of them), and the match against the remaining hash is done back here, locally. There is no way for the API, or for us, to reconstruct your password from a 5-character hash prefix. We never see the password either — this check does not touch our server at all.

Email exposure

We don't run an email-breach checker here — the authoritative breach dataset is Have I Been Pwned's own, and its email lookup is best used directly at the source, where the data is always current. Check your address with them:

Check an email address on haveibeenpwned.com →

Have I Been Pwned lets you search an email address against known breaches, and offers a free notification service that alerts you if the address turns up in a future breach.

Beyond these two checks, the LeakCheck entry in the tools directory is a freemium breach-search engine for exposed emails, usernames and passwords if you want a second source to cross-check against.