Password Breach Checker
Check if a password has been exposed in a known data breach — without ever sending the password itself.
1. Hash locally. Your password is converted into a SHA-1 hash — a fixed-length fingerprint — entirely inside your browser using the Web Crypto API. The plain password never leaves your device.
2. Send only a fragment. Only the first 5 characters of that 40-character hash are sent to the "Have I Been Pwned" Pwned Passwords API. That's not enough information to reconstruct your password or even your full hash.
3. Match locally. The API responds with every breached password hash that shares those first 5 characters — typically several hundred entries. Your browser checks that list for an exact match against the remaining 35 characters, entirely on your device.
This technique is called k-anonymity, and it's the same approach designed by the creator of Have I Been Pwned specifically so services (and tools like this one) can check a password against known breaches without ever transmitting or storing the password itself.
About Password Breach Checker
Password Breach Checker uses the "Have I Been Pwned" Pwned Passwords k-Anonymity API to check if a password has appeared in a known data breach — without ever sending the password itself anywhere. Your password is hashed with SHA-1 right in your browser, and only the first 5 characters of that hash are sent to the API. The exact match is then found locally, among the few hundred results the API returns for that prefix. This is the same privacy-preserving technique used internally by 1Password, Firefox Monitor, and other password managers.