Password breach check

See whether a password appears in known breach data without sending the password, or even its full hash, anywhere.

What actually crosses the network

SHA-1 of your input (computed here): —
Sent to the range API: — (first 5 of 40 hex characters)
Candidates returned: —, compared in this page

The browser hashes the password with SHA-1, sends only the first five hexadecimal characters to the Pwned Passwords range API, receives every suffix that shares that prefix, and looks for its own suffix locally. A match means the password has been seen in breach data and should be retired. No match does not prove the password is strong.

Static demo of one technique. The full checker with a strength meter and a common-password list is at pwcheck.fyi. Breach data: Have I Been Pwned.