How to Check if Your Password Was Leaked (Safely, for Free)
Worried your password is in a data breach? Learn how to check safely using k-anonymity — your password never leaves your device — with a free Pwned Password checker.
Billions of passwords have been exposed in data breaches over the years. If you've reused a password anywhere, there's a real chance it's already on a list that attackers use for 'credential stuffing'. The good news: you can check whether a password has appeared in a known breach — safely, without ever sending the actual password anywhere.
How can checking be safe?
The trick is a technique called k-anonymity. Instead of sending your password (or even its full hash) to a server, your browser hashes the password locally, sends only the first 5 characters of that hash, and receives back a list of all breached hashes that share those 5 characters. The final match is done on your own device. The server never learns your password or even its complete hash.
A well-built breach checker never transmits your password. If a tool asks you to type a password and submits it in full to a server, do not use it.
Step by step: what actually happens
- You type a password into the tool (it stays in your browser).
- The browser computes a SHA-1 hash of the password locally.
- Only the first 5 hex characters of the hash are sent to the breach API.
- The API returns every breached hash suffix beginning with those 5 characters.
- Your browser checks the list locally and tells you if there's a match — and how many times it has been seen.
What to do if your password was leaked
- Stop using it everywhere immediately — assume it is public.
- Change it on every account that used it.
- Switch to unique passwords per site (a password manager makes this painless).
- Turn on two-factor authentication (2FA) wherever possible.
- Check the strength of your new password before committing to it.
Why password reuse is the real danger
A single leaked password is only dangerous because people reuse it. Attackers take a username/password pair from one breach and try it on dozens of other services — banking, email, social media. Unique passwords break this attack entirely: even if one site is breached, the damage is contained to that one account.
The bottom line
Checking whether your password has leaked is fast, free, and safe when done with k-anonymity. Make it a habit: check your important passwords, replace any that have been seen in a breach, and never reuse them across sites.