securityemma
Free ebook

— A quick check

Has your password leaked?

Check whether a password has ever appeared in a known data breach — without it ever leaving your device.

🔒 Your password itself is never sent anywhere. It's hashed (SHA-1) right here in your browser, and only the first 5 characters of that hash are sent to Have I Been Pwned — a technique called k-anonymity. Thousands of other passwords share that same prefix, so nothing identifiable ever leaves your device. This is the same method used by Firefox, 1Password, and Chrome's built-in password checks.

How this actually works

  1. Your password is converted into a scrambled fingerprint (a SHA-1 hash) directly in your browser.
  2. Only the first 5 characters of that fingerprint are sent to Have I Been Pwned's database of 800+ million breached passwords.
  3. Thousands of unrelated passwords share those same 5 characters, so the request can't identify your actual password.
  4. Have I Been Pwned sends back every fingerprint ending that shares that prefix — matching happens locally, in your browser, against that list.

If this password turned up somewhere — or even if it didn't — a password manager means you'll never have to wonder again. It generates and remembers a strong, unique one for every account.

Get the free guide →