Password breach check

Find out whether a password has appeared in a known data breach.

Your password never leaves this page. The browser turns it into a SHA-1 hash and sends only the first 5 characters of that hash to Have I Been Pwned, which returns hundreds of matching hashes; the comparison happens here.

If your password was found

Stop using it everywhere, starting with email and banking. Attackers take leaked passwords and try them on other sites, so a password that has leaked once is unsafe on every account that uses it. Turn on two-factor sign-in where you can.

Breach data comes from Have I Been Pwned’s Pwned Passwords service, which holds hundreds of millions of passwords seen in real breaches.