Private tool
Leaked password check
Only the first 5 characters of a SHA-1 hash leave your browser. Your password is never stored and never logged here.
How privacy works
Your browser hashes the password with SHA-1 via WebCrypto. Only the first 5 hex chars go to api.pwnedpasswords.com/range/<prefix> with the Add-Padding: true header. Matching the suffix happens locally. We do not log or analytics-track the password.
This product uses Pwned Passwords by Have I Been Pwned — credit to Troy Hunt / HIBP as required by their terms.