See if a password has appeared in known breach data. It is hashed in your browser and never sent to us.
Your password is hashed locally with SHA-1. Only the first 5 hash characters leave your browser.
You type a password into the box above — it stays in your browser tab
Your browser converts it into a SHA-1 hash — a one-way fingerprint that cannot be reversed back into your password
Only the first 5 characters of that hash are sent to look up matching records — this is called k-anonymity
The response lists thousands of partial matches — your browser checks the list locally to see whether yours is in it
You get your answer in about 2 seconds. Your actual password was never transmitted to anyone
It tells you whether a specific password has appeared in known data breaches. If it has, attackers already have it on the lists they use to break into accounts — so it is no longer safe to use anywhere. This checker hashes the password in your browser and never sends it to our servers.
Attackers take billions of exposed passwords and try them automatically against email, banking, shopping, and social accounts. If yours is on those lists, every account using it is one automated attempt away from takeover. Changing it — and never reusing it — removes that risk.
A password manager after a breach creates a unique password for every account so you are not reusing the one that just showed up in breach data. Bitwarden’s free tier is enough to stop reuse. Recommendations appear in the result if this password was found.
Yes. Your password never leaves your device. Your browser hashes it with SHA-1 and sends only the first five characters of that hash to look up matches — a method called k-anonymity. The full password is never transmitted, stored, or seen by us.
It means that exact password has appeared in known breach data and sits on the lists attackers use for automated login attempts. Stop using it on every account immediately and replace it with a unique password you have never used anywhere else.
Not necessarily. It only means that specific password has not appeared in the known breach data we check. A short or predictable password can still be weak even if it has never been leaked, so length and uniqueness still matter.
Yes — it is completely free with no signup, no trial, and no payment. Your password is checked privately using k-anonymity and is never stored.
