How to check if your password was leaked

Hardly anyone finds out when their password is stolen. No alert arrives, nothing odd happens on the computer, and the affected service may take months to admit it. What often does happen is that one day someone logs into another of your accounts, one that had nothing to do with it, using the same password.

Understanding how that happens is the best way to prevent it, and checking whether a password is already in circulation is simpler and safer than it sounds.

What a breach is

A breach is the moment a service’s database, with its users and passwords, ends up in the wrong hands. It may be an attack, a misconfigured server or a careless employee. Those databases are sold, traded and, sooner or later, published on forums.

A well-built service does not store your password as it is, but a fingerprint of it (a hash): a mathematical result that cannot be directly reversed. The trouble is that many passwords are so common that their fingerprints are already known, and the rest can be guessed by trying millions of combinations per second. In practice, a good share of every breach ends up cracked and sitting in plain-text lists.

Why someone else’s breach is your problem

Because of credential stuffing. Someone holding a list of leaked emails and passwords from one service does not try to guess anything: they test those same pairs, automatically, on hundreds of other services. Email, banking, shops, social networks, your website’s admin panel.

It works because people reuse passwords. If you used the same one on a forum that was attacked in 2015 and on your work email, the second account is as exposed as the first, even though its provider did nothing wrong.

So the useful question is not “have I been hacked?” but “does any of my passwords appear on a list that is already out there?”. If it does, someone is trying it somewhere.

Have I Been Pwned and its password database

Have I Been Pwned is a project created by security researcher Troy Hunt that collects public breaches. It has two parts: one tells you whether your email address appears in a breach, and the other, Pwned Passwords, holds hundreds of millions of passwords that have turned up in real breaches, each with the number of times it has been seen.

That second database is queried by password managers and by many companies’ sign-up forms to reject passwords already compromised, and it reflects what guidance such as the US NIST’s recommends: demanding capitals and symbols is not enough; passwords that are already on lists should be refused.

Checking without handing the password over

This is the clever part. Sending your password to a service to ask whether it knows it would be absurd: you would be giving away exactly what you want to protect. The solution is called k-anonymity by hash prefix, and an analogy makes it clear.

Imagine you want to know whether your phone number is on a list, but you do not want to tell the list’s owner. You ask: “give me every number starting with 555 12”. They hand over several thousand, and you look for yours at home. The owner knows you asked about that prefix, but not which of the thousands of numbers is yours, or even whether it is there.

Passwords work the same way, only more safely:

1. Your browser computes the password’s SHA-1 fingerprint: 40 characters such as 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
2. It sends only the first five (5BAA6).
3. The service returns every fingerprint in its database starting that way, usually hundreds, each with its count.
4. Your browser looks for the rest of your fingerprint in that list, without it ever leaving your device.

There are just over a million possible five-character prefixes, and each is shared by an enormous number of passwords. The service never receives the password or the full fingerprint, and cannot tell which of the candidates was yours.

Reading the result

If it appears, that password is burnt, even if you made it up yourself and it feels unique. It makes no difference whether it appears once or a hundred thousand times: it is already on the lists used to test accounts. The count only tells you how common it is.

If it does not appear, it means it is not in the breaches collected, not that it is a good password. A short or predictable password may be on no list at all and still fall within minutes to a trial-and-error attack. Length still carries the most weight: a phrase of several unrelated words holds up better than eight characters with symbols.

What to do if your password turns up

1. Change it on every service where you use it, not just one. Start with your email: it is the key that lets someone reset all the others.
2. Use a password manager. It generates and remembers a different, long password for each service, and it is the only realistic way to stop reusing them. Many already warn you when one of your passwords appears in a breach.
3. Turn on two-step verification (2FA) wherever you can, especially for email, banking, hosting and the company’s social accounts. With it, a leaked password is no longer enough to get in. An authenticator app or a security key is sturdier than an SMS code, and passkeys, where available, do away with the password altogether.
4. Review recent activity on the important accounts: open sessions, forwarding rules in your email, changes to contact details.
5. Check your email address too on the Have I Been Pwned website, which tells you which specific breaches it appears in and alerts you to new ones.

In a business, the same goes for shared accounts: access to hosting, the domain, the website’s admin panel or social media. They do the most damage if they fall and are the ones most often carrying a password recycled for years. Securing accounts is one layer; the website itself has its own, such as HTTP security headers.

Checking yours

Our pwned password checker runs exactly the process described: it computes the fingerprint in your browser, sends only the first five characters to Pwned Passwords and compares the rest on your device. It tells you whether the password appears and how many times, and adds a reading of its length and composition to guide you even when it does not appear.

If you want to be sure nothing else leaves, open your browser’s developer tools while you use it: you will see a single request with five characters in the URL.

---

A leaked password is not a disaster if you find out in time and have not repeated it elsewhere. The habit that really protects you is simple: a different password per service, kept in a manager, and a second verification step on the accounts that matter.