Check a password against breaches
Find out whether your password has appeared in known breaches. Only the first five characters of its hash leave your browser — they reveal nothing about what you checked.
How it works
Why the password stays with you
The scheme is called k-anonymity and works like this. The browser computes the SHA-1 of the password — say 5BAA61E4C9B93F3F…. Only the first five characters go out: 5BAA6.
The response is a list of several hundred hash endings that start with those five characters, each with the number of times it appeared. Your ending is matched against them right here in the browser.
The service on the other side sees a request for “everything starting with 5BAA6”. Tens of thousands of different passwords share that prefix, and the request cannot reveal which one you cared about. We additionally ask for the response to be padded with blank rows so that even its size gives nothing away.
The check runs only on the button. If it fired while typing, every keystroke would send a new prefix — and that chain of requests could be used to reconstruct what you typed.
What to do with the answer
The password was found in breaches
This is not “possibly compromised” but definitely: the combination sits in public databases that crackers use. The number shows how many times it appeared — the higher it is, the closer to the top of their lists the password sits and the sooner it gets tried.
What to do. Change the password everywhere it was used, starting with your email — that is the recovery path to everything else. Switch on two-factor protection. Review active sessions and linked devices.
Do not just shuffle characters. “Summer2024!” → “Summer2024!!” does not help: substitution rules in cracking tools cover such variations first. You need a fresh random password.
The password is not in the database
That only means it has not appeared in known breaches — and says nothing about strength. “Michael2015” may be absent from the databases and still fall in minutes. To judge strength use the password checker: it measures entropy and looks for patterns, fully offline.
Questions
Frequently asked questions
Does the password reach a third-party server after all?
No. The SHA-1 of the password is computed in your browser and only its first five characters are sent. The response is a list of hundreds of hash endings that start with those five characters, and the match is found locally in your browser. The service on the other side sees a request for “everything under 5BAA6” and cannot tell which of the thousands of passwords you were interested in. The scheme is called k-anonymity.
What does “found 12,345 times” mean?
That is how many times this exact combination appeared in the collected breaches. The higher the number, the closer to the top of a cracker’s list it sits — such passwords are tried first. Even a single hit means the password is compromised and must be changed everywhere it was used.
The password is not in the database — does that mean it is strong?
No, those are different things. Absence only means it has not appeared in known breaches. A password like “Michael2015” may be missing there and still fall in minutes. Judge strength on the password checker page; this page only knows breach history.
Why does the check not run automatically as I type?
Because then every keystroke would send a new request, and that chain of requests could be used to reconstruct what you typed. The check starts only when you press the button — exactly one request per password.
Can this check be switched off entirely?
Yes. It is the only tool on the site that contacts an external service. If that does not suit you, the site owner can clear the breach_api setting in config.php — the page disappears and every other tool keeps working fully offline.
Next