Password breach checker

Checks a password against the Have I Been Pwned corpus of billions of breached passwords, without revealing it: the password is hashed in your browser and only the first five characters of the hash are sent, so the service (and we) never learn the password or even its full hash. Any password that appears here should never be used again, anywhere.

How k-anonymity keeps this private

The browser computes the password's SHA-1 hash locally, sends the first five hex characters to the range API, and receives every known breached hash starting with those characters (several hundred). The match, if any, happens on your machine. The service cannot tell which of the hundreds you were interested in, or whether you matched at all.

What a hit means

The password exists in cracking dictionaries, so attackers try it early. It does not necessarily mean your account leaked, but the password is burned regardless: retire it everywhere and generate a replacement with the password generator.