Check if your password has appeared in a known data breach
Data breaches are a routine fact of the modern internet: services large and small get compromised, and the stolen email-and-password lists circulate for years. Attackers weaponise them through credential stuffing — automatically trying leaked combinations on banking, email, shopping, and social accounts, because they know most people reuse passwords. A password exposed in one obscure forum’s breach becomes a key tried in every other lock you own.
This tool checks your password against HaveIBeenPwned, the security industry’s reference database of billions of passwords recovered from real breaches. A result of zero means the password has never appeared in that corpus. Any other number means attackers’ wordlists likely contain it — and it should be considered burned, regardless of how strong it looks.
The clever part is checking without revealing: a technique called k-anonymity. Your password is hashed on your device, and only the first five characters of the hash — shared by thousands of unrelated passwords — are ever transmitted. The database cannot reconstruct what you typed from that fragment; your browser does the actual matching locally. You get an answer from a global breach database without your password, or anything usable, leaving your device.
Yes. Your password never leaves your browser — it is hashed locally and only a five-character hash prefix is sent, which maps to thousands of different possible passwords. Neither this site nor the breach database ever sees your password or enough information to derive it.
Change it promptly on every account that uses it, starting with email and banking. Replace it with a unique password per account (our generator helps), store them in a password manager, and enable two-factor authentication on important accounts so a leaked password alone is not enough to get in.
Not necessarily. Zero means it has not appeared in known breach data — but a weak password can still be guessed by pattern-based cracking. Use the breach check and a strength check together: a good password is both unbreached and structurally strong.
A long-running, widely respected security project that aggregates passwords recovered from real-world data breaches into a searchable corpus of billions of entries. It is the standard reference that security teams, browsers, and password managers check against.
Yes — visiting haveibeenpwned.com and searching your email shows which breached services included your accounts and what data was exposed. Knowing which services leaked helps you prioritise which passwords to rotate first.