BrowserTools

Password Breach Checker

Check if a password has been leaked

By Guga — BrowserTools maintainer, Tbilisi, Georgia Updated 2026-09-06
Free No sign-up Uses a third-party API

This check does contact a third party. Your browser hashes the password locally and sends only the first five characters of the SHA-1 digest to api.pwnedpasswords.com, which returns a list of matching suffixes for comparison in the page. Neither the plaintext nor the full hash is transmitted, and this site stores nothing, but the request is a real outbound call visible in your network activity.

What is Password Breach Checker?

Press Check and the page hashes what you typed with SHA-1, sends the first five characters of that digest to api.pwnedpasswords.com, and receives back every hash suffix beginning with those same five characters — typically a few hundred lines. The comparison then happens in your browser: if the remaining 35 characters appear in that list you get the number of times the string has turned up in collected breaches, and if they do not you get a clean result. The plaintext is never part of the request and neither is the rest of its hash. This prefix-range design is called k-anonymity, and it is the arrangement security researchers asked the operator of that database to adopt. A miss means the string is absent from those corpora, not that it is a good password.

Check whether a password has appeared in known data breaches using the k-anonymity API — only a short hash prefix is ever sent, so the password itself never leaves your device.

Runs In Your Browser

Runs in your browser, but this tool contacts a third-party service to do its job. The overview above says exactly what is sent.

Step-by-Step

How to use Password Breach Checker

1

Type or paste the password into the Password field and press Check; the eye button reveals what is in the field.

2

The browser computes the SHA-1 digest through the Web Crypto API and keeps the trailing 35 characters in the page.

3

Only the leading 5 characters become a path on https://api.pwnedpasswords.com/range/, and the suffix list comes back.

4

Read the verdict panel: the occurrence count when a suffix matched, or a not-found message when none did.

Key Capabilities
  • The plaintext and the full digest both stay in the page; only the first 5 hex characters of the hash cross the network.
  • Matching happens locally against the returned suffix list, so the browser is the only party that ever holds the complete hash.
  • A hit reports the occurrence count from the corpus rather than a bare yes or no, which hints at how far the string has spread.
  • Hashing runs through crypto.subtle.digest, so the browser's native SHA-1 does the work rather than a hand-rolled routine.
Common Use Cases
  • A cautious user checks a password they used years ago before reusing it anywhere, and changes it when a hit comes back.
  • An administrator runs a short list of candidate shared-secret passwords through the check before proposing one to a team.
  • A developer who found a plaintext credential in a config file gets a count for how widely circulated that exact string already is.
Clear Answers

Frequently Asked Questions

If only five characters are sent, can the service reconstruct my password?
Not without doing the guessing itself. Five hex characters is one million buckets and the reply contains only the suffixes inside yours. Turning that back into the original string would mean hashing candidate after candidate, which is precisely the work the protocol leaves on the attacker's machine.
Why SHA-1, when it is a broken hash function?
Because it is serving as a lookup key rather than a defence. The corpus is indexed by SHA-1, so matching that index means computing the same digest. Nothing here depends on the strength of SHA-1 to protect anything; if the digest were secret, the query could not be made at all.
What does a clean result actually prove?
Only that the string is missing from the corpora that service tracks. A password can still be trivially guessable, can appear in a breach that was never published, or can already sit in a credential-stuffing wordlist compiled elsewhere. Read a miss as one useful signal among several.
Why did the check fail while I was online?
The message names the HTTP status the service returned and states plainly that your password was not sent. A burst of checks in quick succession is rate limited, a content blocker can intercept the request, and some networks block the host outright.

Related Guides

View all guides →
randomPassword Security in 2026: What NIST Actually RecommendsNIST now says long, random, checked against breaches beats C0mpl3x! rules. Build a 2026-proof password strategy that humans can actually follow.