Password breach check
See whether a password has turned up in a data breach. The password itself never leaves your browser.
Only the first 5 characters of the password’s SHA-1 hash are sent to Have I Been Pwned; the password and full hash stay in your browser.
How it works
Your browser hashes the password with SHA-1 and sends only the first five characters of that hash to the Pwned Passwords service run by Have I Been Pwned. The service returns the endings of all breached hashes that begin with those five characters, usually several hundred, plus random padding so the size of the reply gives nothing away. Your browser then looks for the rest of your hash in that list. This method, called k-anonymity, means neither Have I Been Pwned nor AngelForce learns your password or its full hash.
Reading the result
A count above zero is the number of times the password appears in the breach data. Attackers load these lists into their cracking tools, so treat any password found here as public, however complex it looks. Not found does not mean strong: a short or predictable password can still be guessed. The check covers the password only. It does not tell you which accounts or breaches were involved.
Questions
Is it safe to type a real password here?
Only five characters of the SHA-1 hash leave your browser, and hundreds of breached passwords share them. Nothing is stored. If in doubt, check from a device you trust.
What should I do if my password is found?
Stop using it. Change it everywhere you used it, starting with email and other important accounts, and turn on multi-factor authentication. A password manager makes unique passwords practical.
Why SHA-1?
It is the format the Pwned Passwords service uses for lookups. Here SHA-1 only serves as an index for the range query, not as protection for the password.
Where does the data come from?
From Pwned Passwords, a collection of hundreds of millions of real passwords exposed in data breaches, run by Troy Hunt’s Have I Been Pwned.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Managed securityRelated articles
-
Run a two-hour incident response tabletop this week
Run a two-hour ransomware or account-takeover tabletop with a small team, log the gaps, and turn them into a short runbook with named owners.
-
Passwords and passkeys - what NIST SP 800-63B-4 recommends
NIST's current password rules explained - 15-character minimums, no forced rotation, breached-password checks - plus MFA strength and where passkeys fit.
-
JWT security pitfalls and how to avoid them
Common JWT mistakes - alg none, RS256 and HS256 confusion, weak HMAC secrets, missing claim checks, kid injection, revocation and storage - and the fixes.