Has this password been leaked?

How it checks without seeing your password

Every password exposed in a known data breach has been collected by Troy Hunt’s Have I Been Pwned into a list called Pwned Passwords. Checking against it safely uses a technique called k-anonymity:

1. Hash it hereYour browser turns the password into a 40-character SHA-1 hash, such as 5BAA6…8FD8.
2. Send five charactersOnly the first five, 5BAA6, go to the service. Hundreds of different passwords share any five-character start.
3. Match hereThe service returns every leaked hash beginning that way, padded with dummy entries, and your browser looks for the rest of yours in the list.

So the service never receives your password or even its full hash, and can’t tell which of the hundreds of matching hashes you were checking. You can confirm it yourself: open your browser’s developer tools, look at the Network tab, and you’ll see one request ending in five characters.

What to do if it’s been leaked

• Stop using it everywhere. Attackers try leaked passwords on every popular service (“credential stuffing”). Change it on every account where you’ve used it, starting with email, banking and work accounts.
• Use a different password for every account. A password manager makes that practical; our password generator can create long random ones or easy-to-type passphrases.
• Turn on multi-factor authentication wherever it’s offered, so a leaked password alone isn’t enough to get in.