Password checkup
Review password basics and check a known breach dataset when you are ready. The password itself stays in your browser; the lookup sends only a hash prefix.
Checked in your browser · k-anonymity breach check · nothing stored
The lookup sends the first five characters of a password hash to Have I Been Pwned when you press the button. The password itself stays in your browser.
Our application does not save passwords or lookup results. The external breach service receives the hash prefix and connection metadata. Reloading this page clears the entered password.
Length wins
Use enough randomly chosen characters or words. Long, predictable phrases are still guessable.
Never reuse
A breach on one site only hurts you elsewhere if you reused the password. Unique everywhere keeps the damage contained.
Let software remember
You can’t recall dozens of strong unique passwords — that’s what a password manager is for. Generate, store, autofill.
Generate strong, store safely.
Need a fresh one? Use the generator, then keep it in a password manager so you never have to remember it.
Frequently asked questions
Is it safe to type my password here?
The password stays in your browser. When you start a lookup, the first five characters of its SHA-1 hash are sent to Have I Been Pwned; the full match is checked locally. Our application does not save passwords or lookup results.
What does “found in a breach” mean?
It means that exact password has appeared in a known data leak. Attackers feed leaked passwords into automated login attempts, so any password that’s been exposed should be considered burned — change it everywhere you used it.
Does a missing breach match mean the password is strong?
No. The lookup only detects passwords in the checked dataset. It cannot establish strength, rule out every compromise or identify every dictionary phrase. Use a unique randomly generated password or passphrase.