Password leak check
Has this password leaked?
Your password never leaves this page. Only five characters of its hash do.
Tip: test an old password you no longer use. Try "password1" to see a hit.
Data sources & privacy
Only the first 5 hex characters of the password's SHA-1 hash are sent to api.pwnedpasswords.com (Have I Been Pwned, run by Troy Hunt). That service sees your IP address and the 5-character prefix, which matches around 800 other hashes, so it cannot tell which password you tried. The request carries an Add-Padding header so response sizes do not hint at the answer.
The password and the full hash stay in this tab's memory, are never stored, logged or sent, and the field is wiped after the check. Even so, prefer testing a retired password over one you still use.