Has This Password Leaked?

When a company gets breached, the stolen database rarely stays private. Password dumps get traded on criminal forums, merged into giant "combo lists", and eventually surface publicly. The Have I Been Pwned Pwned Passwords project — the independent breach-notification service this tool queries — collects those leaked passwords into a single searchable corpus of billions of entries, each with a count of how many separate breach records it appeared in.

That count is the number this tool shows you. A password found "3,847 times" isn't a theoretical risk: it sits in thousands of breach records that attackers actively load into automated cracking and login tools. Common passwords appear millions of times; even passwords that feel personal and obscure — a pet's name plus a birth year — often show up hundreds of times, because millions of other people had the same idea.

Two things this tool deliberately does not do. It never stores or transmits what you type — the entire comparison happens in your browser, as the k-anonymity section below explains. And it doesn't measure strength: a brand-new random password will pass this check and a weak one might too. For the strength question, run the same password through our password strength checker — the two checks answer different questions, and a password needs to pass both.

Sending a password to a "leak checker" sounds like the worst idea in security — and if the password actually traveled to a server, it would be. The reason this tool is safe is a protocol called k-anonymity range search, introduced in 2018. Here is the complete flow, step by step:

1. Your browser computes the SHA-1 hash of the password locally, using the crypto.subtle API built into every modern browser. The result is a fixed 40-character hexadecimal fingerprint — for example, the password password123 always hashes to CBFDAC6008F9CAB4083784CBD1874F76618D2A97.
2. The browser sends only the first 5 characters of that hash (CBFDA in the example) to api.pwnedpasswords.com/range/CBFDA. Nothing else. Not the password, not the full hash.
3. The API returns every breached hash that starts with those 5 characters — typically 800 to 1,000 suffixes, each with its breach count.
4. Your browser scans that list locally for the remaining 35 characters of your hash. A match means the password is in the breach corpus; no match means it isn't. The verdict is computed on your machine.

The privacy math is what makes this elegant. Five hex characters give 16⁵ = 1,048,576 possible prefixes, and SHA-1 spreads passwords across them essentially uniformly. So the prefix you send matches roughly one millionth of every password that has ever existed or ever will — millions upon millions of candidate passwords share it. The server learns only that you asked about one of them. That's the "k" in k-anonymity: your query is indistinguishable from k other possible queries, where k is enormous.

The protocol even defends against traffic analysis: this tool requests response padding, so the API inflates every answer with dummy entries and all responses look alike on the wire. An observer watching your encrypted connection can't infer anything from the response size. After you run a check, the tool shows you a "what actually left your browser" receipt — your real hash with the 5 sent characters highlighted — so you can verify the claim rather than take our word for it. This is the same mechanism password managers and even some browsers use for their built-in breach warnings.

Why does a password leaking from one obscure forum matter for your email, your bank, or your streaming accounts? Because of credential stuffing — the single most common way ordinary people get hacked, and it involves no "hacking" of you at all.

The attack chain is an assembly line. First, breach databases from hundreds of sites are merged into combo lists — files with billions of email-and-password pairs, sold cheaply or shared freely. Second, attackers load a combo list into automated tooling that replays every pair against login pages of valuable targets: email providers, banks, payment services, streaming platforms, game stores. Third, the traffic is laundered through huge proxy networks, so the target site sees thousands of ordinary-looking logins from thousands of ordinary-looking home IP addresses instead of one suspicious server hammering the door.

The success rate per attempt is tiny — typically a fraction of a percent — but the volume is astronomical, and every hit is an account takeover that cost the attacker almost nothing. The only reason it works is password reuse: the attacker isn't guessing your password, they're replaying it from a site that already lost it. If the password you checked above came back pwned and you've used it on more than one site, credential stuffing is not a hypothetical — pieces of that attack are likely already probing your accounts.

One connection-level footnote: credential stuffing happens on the attacker's machines, so a VPN can't stop it — only unique passwords can. What a VPN protects is the other route to the same outcome: credentials intercepted or session cookies hijacked on hostile networks like public Wi-Fi. Our best VPN rankings cover that side; this tool and the steps below cover this one. Account security needs both.

A pwned result isn't a reason to panic, but it is a reason to act today rather than this weekend. Work through this list in order:

1. Change it on your most important account first. Email is almost always the crown jewel — whoever controls your inbox can reset every other password you own. Then banking and payment accounts, then everything else.
2. Change it everywhere else you've used it. This is the step people skip, and it's the one credential stuffing exploits. If the same password guards five accounts, all five are burned — changing just one leaves four doors open.
3. Replace it with a unique random password per site. Never a variation of the old one: attackers' tools automatically try password1 → password2 and seasonal suffixes. Our password generator creates strong random passwords entirely in your browser.
4. Store them in a password manager. Unique passwords on dozens of sites are impossible to memorize by design. A password manager makes the secure habit the easy habit — and its autofill refusing to fill on a lookalike domain doubles as phishing protection.
5. Turn on two-factor authentication (2FA). With 2FA, a stolen password alone no longer opens the account. An authenticator app or hardware key beats SMS codes, but any 2FA beats none — prioritize email, banking, and anywhere a payment card is stored.
6. Check whether your email address has been breached too. The address-search side of Have I Been Pwned tells you which breaches included your accounts and what else leaked alongside the password — names, addresses, sometimes partial card numbers. Knowing which breach hit you tells you what phishing to expect next, because breach victims get targeted with convincing "reset your account" lures built from their own leaked data.

The verdict panel is deliberately blunt, but the nuance matters — here is exactly what each outcome does and doesn't mean:

A low count deserves special attention rather than relief. A password seen three times isn't "three times safer" than one seen three million times — it may mean a password you genuinely used was captured in a specific breach, which makes a targeted replay against your other accounts more likely, not less. Treat any non-zero count as a retirement notice.