Password leak test
Is your password
already out there?
Checked against more than 15 billion passwords from real data breaches. Your password does not leave this device. What actually leaves your browser is spelled out below the result, so you can verify it instead of taking my word for it.
What left this device
- Sent
- -
- Not sent
- -
- Requested
- -
- Response
- -
The remaining 35 characters are matched inside this browser. The far end knows every password sharing that prefix, but not which one was meant. Verify it in your browser's network tab.
Your input is hashed in your browser into a 40 character SHA-1 value. Only the first five characters are sent. Around 2,000 different passwords share those five characters, and which one was meant cannot be derived from them. The approach is called k-anonymity and exists for exactly this purpose.
What comes back is a list of every suffix belonging to that prefix, each with a count. Your browser searches that list for the remaining 35 characters itself. The server never learns whether anything matched.
What a clean result does not mean
"Not found" does not mean "good". The only thing checked is whether this password has appeared in a known breach. Not checked: whether it is too short, whether it is a word plus a year, whether you reuse it. And of course not every breach is known.
Data source
The corpus comes from Pwned Passwords by Have I Been Pwned. The service is free and requires no sign-up for this lookup. Details on the transfer are in the privacy notice.