Skip to content

Pwned Password Checker

Check whether a password appears in known data breaches using Have I Been Pwned. Only the first 5 characters of its SHA-1 hash leave your device — never the password.

No uploads

How to use Pwned Password Checker

  1. 1Open Pwned Password Checker. It runs in your browser, no sign-up.
  2. 2Type or paste your input.
  3. 3Copy or download the result.

Questions

Do you send my password to anyone?

No. Your browser hashes the password with SHA-1 and sends only the first 5 hex characters of that hash to api.pwnedpasswords.com. The service returns every leaked hash starting with those characters (hundreds of them), and the match is done on your device. This is called k-anonymity.

What does a match mean?

The exact password appeared in a known data breach and is in attackers’ wordlists. Stop using it everywhere, even if it looks strong.

No match — am I safe?

It only means this password is not in the Pwned Passwords dataset. Still use a unique password per site and turn on two-factor authentication.

More tools

Password Strength CheckerHow long to crack it? TOTP / 2FA Code GeneratorCodes from a secret or QR PGP Encrypt, Decrypt, Sign & VerifyOpenPGP keys and messages Document Metadata RemoverClean PDF, DOCX, XLSX, PPTX Secure NoteEncrypted link, key in the #fragment Background RemoverAI cut-outs, on your device Image Compressor & ConverterWebP, JPEG, PNG in batches Image Resizer & CropperSocial presets, exact pixels