Has your password leaked?

How does the breach check work?

Your device creates a SHA-1 hash of your password and sends only its first 5 characters to Have I Been Pwned. You get back a list of hundreds of possible hashes, and your device looks for the rest itself. Your password, or its full hash, never leaves your device. This method is called k-anonymity.

Is it safe to check my password online?

Here it is, because your password is never sent. Have I Been Pwned only receives 5 characters of a hash, which match hundreds of different passwords. Be careful with sites that ask for your whole password: you cannot know what happens to it.

My password has leaked. Now what?

Stop using it. Change it right away on every site where you use it, starting with your email and your bank, and pick a different password for each site. Turn on two-step verification where you can.

Not found. Does that make my password safe?

Not necessarily. It just isn't in the known breaches. A short password or a word with a year is still quick to guess. A randomly generated password is much stronger.

Do you store my password?

No. Nothing is stored, and nothing is sent until you press Check or Enter. Have I Been Pwned only sees the first 5 characters of the hash and your IP address, like any website you visit.

The check uses the free service Have I Been Pwned.