Leaked Password Checker

How the K-Anonymity Check Protects Your Password

This tool never sends your actual password anywhere. Your browser hashes it locally with SHA-1, then sends only the first 5 characters of that hash to HaveIBeenPwned's API. The API returns every breached password hash sharing that same 5-character prefix — typically hundreds of them — and the match is found locally in your browser. HaveIBeenPwned never sees your full hash or password, a technique called k-anonymity.

What to Do If Your Password Is Exposed

Change it immediately everywhere it's used — attackers run breached password lists against every major login page automatically (credential stuffing), so exposure on one site puts every account sharing that password at risk. Generate a fresh, unique replacement with our Password Generator, and store it in a password manager so you're never tempted to reuse it.