SEOlust logo SEOlust
Security & Privacy

Pwned Password Checker

Check if a password has appeared in a known data breach — without sending it anywhere. Uses k-anonymity: only a 5-character hash prefix leaves your browser. Free and private.

All tools

🔒 Your password is never sent anywhere. This uses the k-anonymity model: your browser hashes the password with SHA-1, sends only the first 5 characters of that hash to the free Have I Been Pwned range API, and compares the returned list locally. The full password and full hash never leave your device.

💡 What the result means

  • A password that appears in breach data has been exposed publicly and should never be used — attackers try these first.
  • Zero matches means it hasn't been seen in known breaches, but that alone doesn't make it strong. Use a long, unique passphrase.
  • If you've ever used a flagged password anywhere, change it on every site that used it.

Pwned Password Checker

Check instantly whether a password has appeared in a known data breach — without ever sending the password anywhere. Your browser hashes it and queries only a short prefix against the free Have I Been Pwned range API, so the password itself stays on your device. Free, private, no sign-up.

Why check a password against breaches

Attackers don't guess passwords blindly — they use lists of billions of real passwords exposed in past breaches. If your password is on one of those lists, automated attacks will try it first, no matter how clever it looks. Checking against breach data tells you whether a password is already burned and must be replaced.

How it protects your privacy

This tool uses <strong>k-anonymity</strong>. Your browser computes the SHA-1 hash of your password, then sends only the first five characters of that hash to the Have I Been Pwned range API. The service returns every breached hash sharing that prefix, and the comparison happens locally in your browser. The full password and full hash never leave your device, so the checker can't learn what you typed.

How to use it

Simple and instant:

  • Type or paste the password you want to check.
  • Click Check — the result appears in about a second.
  • If it's found in breaches, stop using it everywhere and pick a new one.
  • If it's not found, still make sure it's long and unique.

What the count means

When a password is found, the tool shows how many times it has appeared across breach datasets. A high count means the password is extremely common and dangerous; even a count of one means it has been publicly exposed. Any non-zero result is a signal to change that password on every account where you used it.

Not found isn't the same as strong

A zero result only means the password hasn't shown up in the breaches this database tracks — it doesn't guarantee strength. A short or predictable password can still be cracked by brute force. Combine this check with good habits: long unique passphrases, a password manager, and two-factor authentication. Our Password Strength Checker can rate a candidate before you commit to it.

Is it safe to type my real password?

Yes. Because of the k-anonymity design, your actual password is never transmitted — only a five-character hash prefix is. That said, if you're cautious, you can test a password on a device and network you trust. Everything runs in your browser; nothing is stored or logged on our side.

FAQ

Is my password sent to a server?
No. Your browser hashes it and sends only the first five characters of the SHA-1 hash. The full password and hash never leave your device.
Is this tool free?
Yes. It's completely free, needs no account, and uses the free Have I Been Pwned range API.
What does it mean if my password is found?
It has appeared in a public data breach. Stop using it immediately and change it on every account where you used it.
If it's not found, is my password safe?
It means the password hasn't appeared in tracked breaches, but that alone doesn't make it strong. Use long, unique passphrases and 2FA.
What is k-anonymity?
A privacy technique where only a short hash prefix is shared, so the service returns many possible matches and can't tell which one is yours. The final comparison happens locally.
Does it store what I type?
No. Nothing you enter is stored or logged. The check runs entirely in your browser.
How should I create a strong password?
Use a long, unique passphrase for each account, store them in a password manager, and enable two-factor authentication. Try our Password Strength Checker to rate candidates.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.