BREACH LOOKUP

PASSWORD
CHECK

Has your password appeared in a known breach?
Find out without exposing it.

01 Your password is hashed with SHA-1 locally in your browser
→
02 Only the first 5 characters of the hash are transmitted
→
03 Matching suffixes are returned and checked client-side

◈ Your full password never leaves your device. Only the first 5 characters of its SHA-1 hash are transmitted.
◈
K-ANONYMITY MODEL

This check uses the Pwned Passwords k-anonymity API by Troy Hunt. The full password hash is never transmitted — only a 5-character prefix. The server returns all matching suffixes and the match is resolved entirely in your browser. Learn more ↗