Hashed on your device
Your browser computes the SHA-1 hash of the password. Nothing is sent yet.
Free tool
Has this password leaked?
Checked against more than a billion passwords from real breaches, without the password ever leaving your device.
How it stays private
Only 5 characters leave
We ask for every hash starting with those first 5 characters: hundreds of candidates, padded with decoys.
Matched locally
The comparison happens in your browser. Neither we nor the service ever see the password or its full hash.
Want to know where your email has leaked, not just a password?
Check an emailPassword data from Pwned Passwords by Have I Been Pwned, licensed CC BY 4.0.