Password breach checker
Password breach checker: find out how many times a password has appeared in leaked databases. Only the first five characters of a one-way hash are sent, never the password.
How it works: your browser makes a SHA-1 hash of the password and sends only its first 5 characters to the Pwned Passwords service, which returns all matching suffixes. The match is made on your device.
About the password breach checker
Password breach checker: find out how many times a password has appeared in leaked databases. Only the first five characters of a one-way hash are sent, never the password.
Part of SmartCalcy’s security & encoding tools. It runs in your browser with no account, uses your own currency and units (change them at the top of the page), and gives estimates for information only, so check official guidance before you rely on a result.
How to use the password breach checker
What it calculates and when to use it
Checks whether a password has appeared in known data breaches, using the Pwned Passwords service. The password is never sent: your browser sends only the first five characters of its SHA-1 hash and compares the answers on your device. This is called k-anonymity.
How to use it, step by step
- Type the password into the box.
- Press “Check password”.
- See whether it was found and how many times.
- If it was found, stop using it everywhere and change it.
What each input means
- Password to check – The password you want to test. It stays in your browser.
How to read the results
- Result – Found in breaches with a count, or Not found.
The formula
Your browser computes SHA-1(password), for example 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8 for “password”. It sends only the first 5 hex characters, 5BAA6, and receives all hash endings that start with them, then looks for the remaining 35 characters locally.
A worked example
The password “password” is found millions of times. A long random password usually returns Not found.
Assumptions and limits
- The check only covers passwords that appeared in breaches known to the service.
- Not found does not mean strong. A short guessable password can still be cracked.
- Requests to api.pwnedpasswords.com are made only when you press the button.
Common mistakes
- Reading Not found as a sign the password is safe.
- Testing a password with a typo and getting a misleading result.
- Reusing a found password anywhere after seeing the result.
Frequently asked questions
Is it safe to type my password here?
The password never leaves your browser. Only a 5-character piece of its hash is sent, which matches hundreds of other passwords.
What does the count mean?
The number of times the password appeared across breached data sets.
What should I do if it was found?
Change it everywhere you used it, use a unique password for each account and turn on two-factor authentication.
Who runs the service?
Pwned Passwords is run by Have I Been Pwned, using breach data.