OnlinePassword.
Free · Private · Runs in your browser

Password Breach Check — has this password been leaked?

If your password appears in a known data breach, attackers already have it — and the longer it stays in use, the greater the risk. Type a password below to see instantly whether it has been exposed, and how many times. Nothing is stored, tracked or sent in full.

Press Enter or click the button. Only the first 5 characters of a local SHA-1 hash are ever sent — see “How it works”.

🔒 Hashed locallySHA-1 is computed in your browser, never on a server.
🕵️ K-anonymityOnly 5 hash characters are sent — safe even if you check a password you still use.
🧹 Nothing storedNo logs, no cookies, no tracking. Your input is discarded on reload.

What the result means

Found in breaches → treat it as compromised. Change it everywhere it is used, straight away. If it protects anything important — email, banking, work accounts — make it a priority.
Not found → good, but stay cautious. This password has not surfaced in known breaches. Keep it strong, never reuse it across sites, and change it if you have any reason to doubt its security.
Why counts matter: a password found 100,000+ times is common and almost certainly in cracking dictionaries — replace it even if no single breach is critical to you.

Worried about your other passwords? The fix is simple: unique, strong passwords for every account. Generate one now — it takes one click.

Generate a strong password →

How it works

This checker uses the free Pwned Passwords service by security researcher Troy Hunt — a database of over a billion real passwords exposed in data breaches. Your browser hashes the password you type (SHA-1), keeps the hash to itself, and requests only the list of breached hashes beginning with the same 5-character prefix. The comparison happens locally, so your password — and even its full hash — never leaves your device. The same k-anonymity design is used by password managers and security tools worldwide.

Frequently asked questions

Is it safe to type my password into this breach checker?

Yes. Your password never leaves your device in full. It is hashed locally in your browser with SHA-1, and only the first 5 characters of that hash are sent to the Have I Been Pwned range API — not enough to reconstruct anything. This is a technique called k-anonymity, built into the API for exactly this purpose.

Does this tool send my password over the internet?

No. Your browser computes the SHA-1 hash, sends only the first 5 characters of that hash to the Pwned Passwords API, receives the list of breached hashes with that prefix, and compares the rest locally. The full password and full hash never leave your device.

What does it mean if my password was found?

It means that exact password appeared in one or more known data breaches. Treat it as compromised — stop using it, change it on every account that uses it, and use a unique password per account from now on (a password manager makes this practical).

What should I do after checking?

If the result is bad: change the password everywhere immediately, enable two-factor authentication on important accounts, and never reuse the old password. If the result is clear: keep using strong, unique passwords and re-check whenever you hear about a breach affecting services you use.

Is this tool free and unlimited?

Yes. There is no sign-up, no cost and no usage limit, thanks to the free Pwned Passwords range API.

Disclaimer: OnlinePassword provides this breach checker for educational purposes. It queries the public Pwned Passwords range API by Have I Been Pwned (Troy Hunt); OnlinePassword is not affiliated with or endorsed by Have I Been Pwned. A “not found” result does not guarantee a password has never been compromised — it only means it is absent from the known breach dataset. Always use strong, unique passwords and enable two-factor authentication where available.