Free tool

Password Breach Checker

Find out if a password has appeared in a known data breach. It's checked privately, and the password never leaves your browser.

Private by design: your browser hashes the password and sends only the first 5 characters of that hash (k-anonymity). The password itself is never transmitted or stored.

What this checks

Turns your password into a SHA-1 hash inside your browser.
Sends only the first five characters of that hash to the Pwned Passwords range service.
Receives the list of breached hash endings that share those five characters, and compares them with yours locally.
Shows how many times the password has appeared in known breach data, or confirms it was not found.

Why it matters

Attackers take passwords leaked from one breach and try them on email, banking and work accounts, a technique called credential stuffing. If a password your staff use has already appeared in a breach, it is on the lists attackers try first, no matter how complex it looks. This check shows that without the password itself ever leaving your device.

How to read the result

Any count above zero means the password has been seen in breach data and should be retired everywhere it is used.
A high count means it is a common password that attack tools try very early.
Not found is good, but it only means it is absent from known breaches. It does not make a short or predictable password strong.
The check covers passwords only. It does not tell you whether a particular email address was involved in a breach.

How to fix what it finds

Change a breached password on every account where it was used, starting with email, since email resets everything else.
Replace it with a generated password and store it in a password manager.
Turn on two-factor authentication for accounts that used the breached password.
For systems you run, reject known breached passwords at sign up and password change, as NIST SP 800-63B recommends.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Is it safe to check my password for breaches online?

With this method, yes. The password is hashed in your browser and only the first five characters of the hash are sent, a technique known as k-anonymity, so the service never learns the password.

My password was found in a breach. What should I do?

Stop using it everywhere, starting with your email account, and replace it with a unique generated password. Then turn on two-factor authentication.

How can a password appear in a breach if I was never hacked?

Breach lists record passwords, not people. If someone else anywhere chose the same password and their account leaked, it appears in the data, which is why common passwords show high counts.