Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free tool
Check whether a specific password has already shown up in known breach data, using k-anonymity, so only a partial hash fragment is ever sent anywhere, never the password itself. Complements the Password Strength Checker: strength and "already leaked" are two different questions.
Your password never leaves your browser as plain text, it's hashed locally, and only the first 5 characters of that hash are ever sent anywhere (k-anonymity). Have I Been Pwned's Pwned Passwords service can't reconstruct your password from that, and neither can we.
By using this tool, you agree to our Terms of Service , only run it against something you own or are authorized to assess.
Weak or reused credentials are still one of the most common ways in, we help assess and harden identity and access controls across your actual environment.