Has your password been leaked?

Check a password against more than 900 million that have been exposed in real data breaches. If it's there, attackers already have it on their lists.

Checked without sending itYour browser scrambles it, and only the first 5 characters of that are used to look it up.
Nothing comes to usThe check goes from your browser to Have I Been Pwned, the database security teams rely on.

Check a password

Type it below. It's checked on this device and isn't saved.

How it works

Checked without being shared

It uses a method called k-anonymity, designed so the password can be checked without anyone else learning it.

1. Scrambled on your device

Your browser turns the password into a SHA-1 fingerprint: 40 characters that can't be turned back.

2. Only 5 characters are sent

Just the first 5 characters of the fingerprint go to Have I Been Pwned. Hundreds of different passwords share them.

3. A list comes back

It sends back every breached fingerprint starting with those 5 characters, padded with decoys so even the size gives nothing away.

4. Matched on your device

Your browser looks for the rest of the fingerprint in that list. Nobody else ever sees which one it was.

Questions

About leaked passwords

My password was found. What now?

Stop using it, everywhere you've used it. Change it first on your email account (it can reset everything else), then your bank, then your website and anything else. Use a different, random password for each one. Our password generator makes them in one click.

It wasn't found. Is it safe?

It hasn't turned up in a known breach, which is good, but it isn't proof that it's strong. Short or guessable passwords can still be cracked. Aim for long, random and used only once.

Where does the data come from?

Pwned Passwords, part of Troy Hunt's Have I Been Pwned: passwords exposed in real breaches, collected so people and companies can avoid them. It's used by security teams and governments around the world.

Do you see the password I check?

No. Nothing about it is sent to us at all, and Have I Been Pwned only ever sees 5 characters of its fingerprint, which hundreds of other passwords share. There's no tracking or advertising code on this page either.

Free tools

More from SecurePress

Encrypted in your browser

Secure link share

Send a password or note as a link that works once, then deletes itself. Encrypted in your browser, so not even we can read it.

Create a secure link

Shows once, then it's erased for good
Not even we can read it: the key is only in your link
Deletes itself if nobody opens it, from 1 hour to 7 days

Made on your device

Password generator

Strong random passwords, made in your browser and never sent anywhere. No adverts, no sign up.

Make a password

Cryptographically random, never a pattern
Length from 8 to 64, with the characters you choose
Nothing is sent anywhere or kept, and no adverts

30+ checks, in plain English

DNS report

Check a domain's nameservers, website, MX, SPF, DMARC and more, in plain English with how to fix each problem.

Run a DNS report

Straight from the registry and each of your nameservers
Website, MX, SPF, DMARC, DKIM, DNSSEC and CAA
Every problem says how to fix it, and downloads as a PDF

For wp-config.php and .env

WordPress salt generator

Fresh security keys and salts for wp-config.php, made in your browser. Change them after a hack to sign everyone out.

Make new salts

All eight WordPress keys and salts, 64 characters each
Made on your device, never fetched from a server
Signs out every stolen session after a hack

By our sister site, SitePulse

WordPress security scan

A free check of your WordPress site from the outside, by SitePulse: the versions it gives away, files that shouldn't be public and common weak spots.

Scan with SitePulse

Spots outdated WordPress, plugins and themes
Finds exposed files and settings attackers look for
Results in seconds, no plugin to install