homedeveloper toolspassword leak checker

Password Leak Checker

Check if a password appeared in data breaches, without sending the password

Press Enter or tap Check. The password is never stored, not even in this browser.

Runs entirely in your browser. Nothing you type or upload is sent to us or stored. How we handle privacy

This tool asks the Have I Been Pwned service for live data. It sends only a five-character fragment of the password's hash (never the password itself). Nothing is stored by us. How we handle privacy

Breach check
Type a password to see its strength, then tap Check.

Runs in your browser. To get live data it sends a five-character fragment of the password's hash (never the password itself) to Have I Been Pwned. Nothing you enter is sent to us or stored. Privacy

Results are for general guidance. Please check anything important before relying on it. Terms of use

How to Use

  1. Type or paste the password into Password to check. Tap the eye icon if you want to see what you typed.
  2. Read the strength estimate that appears straight away. It is worked out on your device and lists any weak patterns it spots, like a year or "1234".
  3. Tap Check or press Enter. The tool hashes the password and sends only the first five characters of that hash to Have I Been Pwned.
  4. A red result shows how many times the password appears in known data breaches. A green one means it wasn't found.
  5. If it was found, change that password on every site where you used it, starting with email and banking. Tap Clear when you're done.

What this password leak checker does

Every year, websites get hacked and their user lists end up on the internet. Attackers collect the passwords from these leaks and try them first on other sites, because people reuse passwords. This password leak checker tells you whether a password you use has appeared in one of those leaks. It uses the Pwned Passwords list from Have I Been Pwned, a free service run by security researcher Troy Hunt, which holds hundreds of millions of real passwords from past breaches.

A password that shows up even once should be treated as burned. It doesn't matter how clever it looks: if it is on the list, it is on the attackers' list too.

How the check works without sending your password

The tool never sends your password, and it doesn't send its full hash either. It uses a method called k-anonymity:

  1. Your browser turns the password into a SHA-1 hash, a 40-character fingerprint.
  2. Only the first five characters of that hash go to the service.
  3. The service replies with every leaked hash that starts with those five characters, about two thousand of them, each with a count.
  4. Your browser looks for the rest of your hash in that list. The match happens on your device.
SHA-1("password") = 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
Sent: 5BAA6
Kept on your device: 1E4C9B93F3F0682250B6CF8331B7EE68FD8

Since thousands of different passwords share any five-character start, the service can't tell which one you checked. The tool also asks for padding, so the reply size doesn't give anything away. When we ran this example in October 2026, "password" came back as seen more than 5.2 crore times.

What the result means

ResultWhat it meansWhat to do
Seen many timesA common password used by lots of peopleStop using it today, everywhere
Seen a few timesIt was in at least one leak, maybe yoursChange it on every site that uses it
Not foundNot in any leak the service knows aboutFine to keep if it is long and used on one site only

"Not found" is not a promise that the password is safe. A short one like Rohan@1995 may never have leaked and still be cracked in minutes, because it follows a pattern attackers try early. That's why the tool also shows a strength estimate. It looks at length, the mix of letters, numbers and symbols, and the patterns cracking tools try first: common passwords, keyboard runs like "qwerty", repeated characters, years and a word followed by a few digits.

If your password has leaked

  • Change it first on your email account. Whoever controls your email can reset most of your other passwords.
  • Then change it on net banking, UPI apps, your stockbroker and any shopping site with a saved card.
  • Use a different password on every site. A password manager remembers them so you don't have to.
  • Turn on two-step verification (an OTP or an authenticator app) wherever it is offered.
  • Never reply to calls or messages asking for an OTP, even if they say they are from your bank.

The password itself is never stored, not on our side and not in your browser. The page forgets it when you close or reload it.

Frequently Asked Questions

Yes. The password is hashed in your browser and only the first five characters of the SHA-1 hash are sent to Have I Been Pwned. That prefix matches thousands of different passwords, so the service can't tell which one you checked, and nothing is stored.

Not necessarily. It means the same password appeared in a leak, possibly from someone else who chose it too. Attackers try leaked passwords on every popular site, though, so change it everywhere you use it, starting with email and banking.

Not by itself. It only means it isn't in the known breach lists. A short or predictable password, like a name and birth year, can still be guessed quickly. Check the strength estimate and use a long, unique password for each site.

From Pwned Passwords, part of Have I Been Pwned, run by security researcher Troy Hunt. It collects passwords from public data breaches, without the usernames, so people can check whether a password has been exposed.

No. This tool checks passwords only. To see whether your email address was part of a breach, use the search box on the Have I Been Pwned website itself.

You Might Also Need

Password GeneratorHash GeneratorTOTP Code GeneratorText Encryption