Check if a password has appeared in known data breaches. Uses HIBP k-anonymity. Only a hash prefix is sent, never the full password.
Uses the HaveIBeenPwned k-anonymity API. Only the first 5 characters of a SHA-1 hash are sent. The full password never leaves your browser.
Checks your password against the Have I Been Pwned Pwned Passwords database using k-anonymity: only the first 5 characters of the SHA-1 hash of your password are sent to the API. The full hash or plaintext password never leaves your browser.
The HIBP database contains over 800 million real-world password hashes collected from publicly disclosed data breaches. If your password hash appears in this list, it has been exposed in a breach somewhere and should not be used.
Password reuse is one of the most common causes of account takeover. Attackers use credential stuffing — taking breach databases and trying those username/password pairs against other services at scale. A password that appeared in a 2015 breach is still being used in attacks today.
This check is useful for security awareness training, helping users understand that their "strong" password may already be in attacker wordlists, and for auditing whether test or default credentials in use across your environment have known exposure.