Enter a password and we'll safely check whether it's appeared in a known data breach. Your password is never sent to any server.
Why is this safe?
- Your password never leaves this browser. It's never stored or transmitted to any server, ever.
- Your browser converts the password into a SHA-1 hash, then sends only the first 5 characters of that hash to our API.
- The server returns a list of hundreds of hashes that share those first 5 characters — it never learns which password you're actually checking (this is called "k-anonymity").
- The match is compared locally, inside your browser. Curious how it works? Read the full explanation in our guides.
100% private
Your password is never sent anywhere
No sign-up
Just type and check
Free
No limits, completely free
k-anonymity
Industry-standard privacy method
Share with a friend
FAQ
Correct. Your browser hashes the password with SHA-1 locally, and only sends the first 5 characters of that hash to our server. The server returns hundreds of hashes sharing that prefix — it never learns your actual password or full hash. This is called "k-anonymity," and you can read the full mechanism in our guides.