Data Breach Password Check (Private-ish)
Quick answer: type a password, tap Check. Your browser hashes it with SHA-1, sends only the first 5 hex characters to Have I Been Pwned, and matches the rest locally. The full password never leaves this device.
🔒 The full password never leaves your browser. We SHA-1 hash it locally, then send only the first 5 hex characters to Have I Been Pwned’s range API (api.pwnedpasswords.com). That is k-anonymity. We do not log the password or the hash.
Important: do not paste a password you are currently using on a shared computer. Prefer checking a similar test password, or use your password manager’s own breach check.
How the private check works
Why
Billions of stolen passwords are sold and sprayed at login forms. Knowing a password was leaked helps you change it before attackers try it.
What
Have I Been Pwned hosts a huge list of password hashes. With k-anonymity, your browser sends only a short hash prefix. Thousands of hashes share that prefix, so the service cannot tell which password you typed.
How
- Type the password in the box.
- Your browser computes SHA-1.
- Only the first 5 hex characters go to
api.pwnedpasswords.com/range/…. - The reply lists many hash endings; your browser looks for a match locally.
Example, step by step
- Input: a known weak password such as
password(do not use this anywhere). - Result: Found in known breaches millions of times.
- What it means: Rahul never uses that string again and creates a unique password in his manager.
Ravindra Bagale's Tip
If a password was seen in a breach, change it everywhere you reused it, then switch to a unique password from a manager. Pair it with two-factor authentication.
Ravindra Bagale's Tip – मराठी
जर password breach मध्ये दिसला, तर जिथे reuse केला तिथे बदला, नंतर manager मधून वेगळा password वापरा. Two-factor authentication सोबत ठेवा.
Ravindra Bagale's Tip – हिंदी
अगर password किसी breach में दिखा, तो जहाँ reuse किया वहाँ बदलें, फिर manager से नया अलग password रखें. Two-factor authentication साथ रखें.
Frequently asked questions
Does the full password leave my browser?
No. Only the first 5 characters of its SHA-1 hash are sent to api.pwnedpasswords.com. The rest of the hash is matched on your device.
Who runs the breach list?
Have I Been Pwned (Troy Hunt). We only call their range API from your browser.
If it is not found, am I safe?
Not guaranteed. New leaks appear often. Still use a long unique password.