PRIVATE BY DESIGN

Has your password
already escaped?

Check a password against known breached-password data without sending the password—or its full hash—anywhere.

01 / CHECK

Enter a password

Your password never leaves this browser. No account. No log.

K-ANONYMITY · 5 CHARACTER PREFIX
RESULT

Your exposure check will appear here.

HOW PRIVACY WORKS

Five characters leave.
Your password does not.

1

Hashed on your device

The password is converted to a SHA-1 hash inside this browser. Hashing is one-way; it is not reversible encryption.

2

Only a prefix is shared

Only the first five characters of the hash are sent to the Have I Been Pwned Pwned Passwords range service. Padded responses reduce information leakage from response size.

3

Compared locally, then cleared

The returned hash suffixes are compared in this browser. This site uses no database, analytics, cookies, or browser storage for your password or result.