The password never leaves your browser. Have I Been Pwned only receives the first five characters of its SHA-1 hash.
How it is checked without sending it
- 01Your browser computes the SHA-1 hash of the password. It is a forty-character fingerprint; the password cannot be recovered from it.
- 02Only the first five characters of that fingerprint are sent to Have I Been Pwned. Hundreds of thousands of different passwords share each prefix.
- 03The API returns the eight hundred to a thousand suffixes starting with that prefix, padded so that not even the response size gives anything away.
- 04The comparison with your suffix happens here. Have I Been Pwned never learns which password you checked, nor whether it was on the list.
How to use it
01
Type it
The field stores nothing and sends it nowhere. You can reveal it to check you have not mistyped.
02
Check
The result says how many known breaches it appears in. One is already enough to rule it out.
03
Act
If it appears, change it on every service where you use it. If it does not, look at the length: that is what really protects it.
What is Have I Been Pwned?
A service created in 2013 by Troy Hunt that collects public data breaches and lets you check whether an email or a password appears in them. Its password database is used by password managers, sign-up forms and law-enforcement tools, which contribute data from cybercrime operations.
The password API is free, keyless and unlimited, and designed so that nobody, not even the service itself, can learn which password was checked.
What to do if it appears
- 1
- Change it everywhere you use it, starting with your email: the rest get reset from there.
- 2
- Use a password manager and let it generate a different one per service. Reuse is what turns one breach into ten.
- 3
- Turn on the second factor wherever it exists. With it, a leaked password is no longer enough to get in.
- 4
- Do not “fix” it by adding a number at the end. Attack lists already include those variants.
The check every sign-up form should make
Since 2017 NIST has recommended comparing every new password against known breach lists and rejecting the ones that appear, instead of demanding uppercase letters and symbols people dodge with “Password1!”. It is a millisecond lookup and prevents most credential-stuffing logins.
In the systems we build, that check runs on sign-up and on password change, with the same k-anonymity model this page uses: neither our server nor Have I Been Pwned’s ever sees anyone’s password.
Frequently asked questions
Is it safe to type my password here?
Yes, and the reason is verifiable: the password never leaves your browser. The only thing that goes out is a five-character prefix of its hash, shared by hundreds of thousands of passwords, and the comparison happens on your device. You can confirm it in your browser’s developer tools: the only request goes to api.pwnedpasswords.com and carries five characters in the URL.
What is k-anonymity?
A model in which what you send is indistinguishable from what at least k other people would send. By sending only five characters of the hash, your query is identical to that of anyone whose password starts with the same prefix, and the service cannot tell which of the hundreds of thousands of candidates is yours.
Why does it use SHA-1 if it is broken?
Because it protects nothing here: it is an index. SHA-1 is broken for signatures, where nobody must be able to forge two documents with the same fingerprint. To look up a password in a list, a stable fingerprint is enough, and since it never leaves in full, its weakness does not come into play. Have I Been Pwned chose it in 2017 for compatibility with the existing database.
Is a password that does not appear safe?
Not necessarily. It only means it is not in the public breaches Have I Been Pwned has collected. “My dog’s name + 2024” may not appear and still be trivial to guess. What makes a password strong is length and the absence of a pattern: a phrase of four or five unrelated words holds up better than eight characters with symbols.
How many passwords are in the database?
Over nine hundred million unique passwords from real breaches, growing every week with data the FBI and other agencies share with the project. It is the same database that password managers and large companies’ sign-up forms query.
Can I check whether my email is in a breach?
Not from here: that is a different query, one that does identify the person, and Have I Been Pwned offers it on its own website with email notifications. This tool checks bare passwords, which is why it can do so without knowing who you are.
Is anything I type stored?
No. The field is not sent to any server of ours, is not stored in the browser and has autocomplete disabled so the browser does not remember it either. Closing the tab leaves no trace.
Background reading
Explained on the blog
How to create strong passwords and actually manage them
Why length beats symbols, what a password manager does, which kind of two-step verification to choose and how to bring order to a team's passwords.
How to check if your password was leaked
What a password breach is, why a password stolen from one service puts all the others at risk, and how to check one without handing it to anyone.
Does your app accept leaked passwords?
Adding this check to sign-up and password change is an afternoon’s work. Preventing logins with stolen credentials, the most common way in, is worth a great deal more.
We reply within one business dayBogotá · UTC−5