Skip to content

Has this password leaked?

Checks against over 900 million breached passwords from Have I Been Pwned.

How your password stays private

  1. Your browser turns the password into a SHA-1 hash. The password itself never leaves this page.
  2. Only the first 5 of the hash's 40 characters are sent. Hundreds of passwords share those 5 characters.
  3. The service returns every matching hash, and your browser checks for a match locally.

How it works

The check uses the Have I Been Pwned range search, a method built so nobody has to send a password anywhere. Your browser turns the password into a SHA-1 fingerprint and sends only its first five characters. The service answers with every leaked fingerprint that starts the same way, often several hundred, and your browser looks for an exact match on its own. Neither Have I Been Pwned nor The Net Fix ever sees the password or the full fingerprint.

Reading your result

Found in leaks
The password appeared in at least one data breach, so attackers already have it in the lists they try first. Change it everywhere you use it, starting with email and banking, and don't reuse it.
Not found
It isn't in any known breach, which is good but not proof it's strong. A long passphrase or a password manager's random password is still the safest choice.

Questions

Is it safe to type my password into a password checker?

Only into one that never sends it, like this one: the password stays in your browser and only five characters of its fingerprint leave the page. Avoid checkers that post the password itself to a server.

My password was found. What should I do first?

Change it on your email account first, since email resets every other password, then anywhere else you used it. Turn on two-step sign-in where you can. For the rest of your security checks, see the business tools.