Free tool · no signup

Password breach checker

Find out whether a password has appeared in a known data breach, privately. Your password never leaves your browser: only the first 5 characters of a one-way hash are looked up.

By the Bug Circuit security team · Last updated November 2, 2026

Can I check a password safely? Yes. The tool hashes your password in the browser with SHA-1 and sends only the first 5 characters of the hash to the Pwned Passwords service, which returns every matching suffix. The match is done on your device, so neither the password nor its full hash is sent.

How it works

How the private check works

The Pwned Passwords database, run by Have I Been Pwned, holds hundreds of millions of passwords from real breaches. Sending a password to look it up would be a bad idea, so the service uses a method called k-anonymity. Your browser makes a SHA-1 hash of the password, takes the first five characters, and asks the service for all hashes that start with them. The service returns a list of several hundred matching suffixes with counts, and your browser checks the rest of the hash against that list itself.

The service never learns the password or even the full hash. We never see anything either: the request goes from your browser straight to the service, and this page does not log it.

What the result means

If a password is found, attackers already have it, and they try known leaked passwords first in credential-stuffing attacks against every site. Change it everywhere you use it. If it is not found, that only means it is not in a known breach: short or predictable passwords are still easy to guess.

The best defence is a long random password or passphrase from a password manager, a different one on every site, plus two-factor authentication on anything important.

For site owners

If you run a website with logins, check new passwords against this database when people sign up or change them, and refuse the ones that appear. NIST's current guidance recommends exactly that instead of arbitrary complexity rules. The same range service can be called from your own server.

Worked examples

A very common password

The word "password".

Found in millions of known breaches

It has been leaked so many times it is the first thing an attacker tries.

A long random passphrase

Four unrelated words and a number from a password manager.

Not found in the breach database

Strong because it is long and unpredictable, not only because it is absent from the list.

Frequently asked questions

Is it safe to type my password here?

The password is hashed in your browser and never sent. Only the first 5 characters of the hash go to the Pwned Passwords service. If you prefer, check a password you no longer use, or one similar to it.

Where does the data come from?

From the Pwned Passwords database of Have I Been Pwned, which collects passwords from public data breaches. This tool is not affiliated with it, we just use its public range API.

What if my password is not found?

It is not in a known breach, which is good. It may still be weak. Use a long random password or passphrase from a password manager and turn on two-factor authentication.

What should I do if my password was found?

Stop using it. Change it on every site where you used it, use a unique password for each, and turn on two-factor authentication on important accounts.

Does this check my email address?

No. It only checks passwords. Email breach lookups are a different service.

Why SHA-1, which is weak?

The hash is only used to look up a list, not to protect anything. The Pwned Passwords service is indexed by SHA-1, so that is what the lookup needs.

Keep reading

JWT DecoderRead and check a token.Cookie Security CheckerCheck how logins are stored.Is my website hackable?What attackers look at first.Free website security checkSee what attackers can see.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing