Meet the Password Breach Checker
Check whether your password has appeared in known data breaches using the Have I Been Pwned database with k-anonymity — your password never leaves.
- Free to use
- No signup
- Nothing to install
- Works in any modern browser
“password123” → found over 2 million times in breaches → never use. A random 16-character passphrase → not found and high entropy → good.Open the Password Breach Checker
Illustration. Open the tool for the real thing.
What is the Password Breach Checker?
Billions of passwords have leaked in data breaches, and attackers try leaked passwords first. This tool checks a password against the Pwned Passwords database — hundreds of millions of real leaked passwords — and tells you how many times it has been seen. If it appears even once, it should never be used again.
Your password stays private: it is hashed with SHA-1 inside your browser and only the first five characters of that hash are sent to the service, which returns every leaked hash starting with those characters; the match is done locally (a technique called k-anonymity). The page also estimates the strength of your password and how long an online or offline attack would take, and warns about common patterns.
3 steps to your result
Open the tool and follow along. Nothing to install.
What you get
Checks the Have I Been Pwned Pwned Passwords database.
Only five characters of a hash leave your device.
Entropy, patterns and estimated crack times.
Nothing is saved, logged or sent to us.
AZRS tools are free to open and use.
It opens in your browser, so there is nothing to download.
Used for
Pick one to see how it fits.
How it compares
A plain look at this tool next to the usual alternative.
| This utility | Desktop software | |
|---|---|---|
| Install | Nothing to install | Usually an app or program to install |
| Account | No signup | Depends on the product |
| Cost | Free to use | Free or paid, depends on the product |
Questions people ask
Is it safe to type my password here?
Yes. It is hashed in your browser and only the first five characters of the hash are sent using k-anonymity. The full password and hash never leave your device. For maximum safety, check a variation instead of a live password.
How does k-anonymity work?
The service returns all leaked hashes that start with your 5-character prefix (hundreds of them). Your browser looks for your full hash in that list, so the service cannot tell which one, if any, is yours.
What if my password is found?
Stop using it everywhere and choose a new, unique password. A leaked password is known to attackers.
Where does the data come from?
The free Pwned Passwords service from Have I Been Pwned, built from real breaches.
What is entropy?
A measure of unpredictability in bits: every extra bit doubles the guesses needed. Above 60 bits is strong for most uses.
More free tools
Related to the Password Breach Checker.
Try the Password Breach Checker now
Find out if your password appeared in a data breach — without sending it. Free to use.
Try it free