Skip to content
StoutNook
Menu
Every tool runs in your browser. Your files never leave your device.

Has my password been leaked?

Type a password to see whether it appears in Have I Been Pwned's list of passwords exposed in data breaches. Your password never leaves your device: only the first five characters of its hash are sent, so the service can't tell what you checked.

Nothing is sent until you click Check password. The password itself never leaves this device.

Only the first 5 of the 40 characters of the password's SHA-1 hash are sent, so Have I Been Pwned can't tell which password you checked.

How this works
  1. Your browser turns the password into a SHA-1 hash: 40 characters of 0–9 and A–F. For example, "password" becomes 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
  2. Only the first 5 characters (5BAA6) are sent. About two thousand different breached passwords share any five-character start, so the service can't tell which one is yours.
  3. It replies with the other 35 characters of every breached hash that starts that way, padded with fake entries so even the size of the reply gives nothing away.
  4. Your browser looks for your hash's ending in that list. The match is made on your device, and nothing is stored or logged.
Type a password, then click Check password. The answer appears here.

Breach data from Pwned Passwords by Have I Been Pwned (Troy Hunt). This site isn't affiliated with it.

  • Only 5 characters of a hash are sent
  • Free, no sign-up
  • Works on phone and desktop

How to check if your password has been leaked

  1. 1

    Type or paste the password you want to check. Nothing is sent while you type.

  2. 2

    Click Check password or press Enter. Only the first 5 characters of its SHA-1 hash leave your device.

  3. 3

    Read the answer: found, with how many times it appears in breach data, or not found.

  4. 4

    If it was found, change it on every site where you use it and turn on two-step verification.

Features

  • Over a billion breached passwords

    Checked against Have I Been Pwned's Pwned Passwords, built from real data breaches and updated as new ones come to light.

  • Your password stays here

    Only 5 of the 40 characters of its SHA-1 hash are sent, so the service can't tell which password you checked.

  • Shows exactly what was sent

    You see the 5 characters that left your device. No cookies, no logging, nothing stored.

  • Clear next steps

    If your password was found, you get a short list of what to do about it, in order.

What Pwned Passwords is

Pwned Passwords is a free service from Have I Been Pwned, the breach-tracking site run by security researcher Troy Hunt. It holds more than a billion unique real-world passwords exposed in data breaches, each stored as a hash with the number of times it was seen, and it grows as new breaches come to light. Password managers and websites use it to warn people away from breached passwords, which is what NIST's digital identity guidelines (SP 800-63B) ask for: new passwords should be checked against a list of common, expected and compromised ones.

Why it matters: attackers don't guess from scratch. They run lists of breached passwords against logins at banks, shops and email providers, and try each stolen email-and-password pair on other sites too, which is known as credential stuffing. A password that appears here is among the first they'll try, however strong it looks.

How k-anonymity keeps your password private

Sending a password, or even its full hash, to someone else would be a risk, because the hash of a common password is easy to look up. So the check uses k-anonymity: your request looks the same as thousands of others. Here is the whole process for the password password:

  1. Your browser computes its SHA-1 hash: 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
  2. It splits the hash in two. The first 5 characters, 5BAA6, are sent. The other 35, 1E4C9B93F3F0682250B6CF8331B7EE68FD8, stay on your device.
  3. Have I Been Pwned replies with the endings of every breached hash that starts with 5BAA6, each with a count: around two thousand lines of the form ending:count.
  4. Your browser looks for its 35 characters in the list. For this password it finds them, with a count in the tens of millions. If they weren't there, the password wouldn't be in the data.

There are 165, or 1,048,576, possible prefixes, and each currently covers around two thousand breached hashes, so 5 characters say next to nothing about your password. This page also asks for padding: the reply is topped up with fake entries that have a count of 0, so someone watching your encrypted traffic can't infer the prefix from the size of the reply. The request is sent straight from your browser to api.pwnedpasswords.com, without cookies or a referrer, and nothing is stored on this site.

What to do if your password was found

  1. Change it on every site where you use it, starting with your email account, since email can reset everything else.
  2. Don't just add a digit. Variations such as Password2 or Password! are tried right after the original.
  3. Give every site its own password from the password generator, and let a password manager remember them.
  4. Turn on two-step verification with an authenticator app, a security key or a passkey, so a leaked password alone can't get anyone in.

Not found? Good, but a password can be weak without ever having leaked. The password strength checker shows how quickly it could be guessed.

Checking your email address is a different check

This page answers one question: is this password known to attackers? To find out which breaches included your account, enter your email address at haveibeenpwned.com, where you can also sign up to hear about future breaches. We don't offer an email check of our own.

Password breach data: Pwned Passwords from Have I Been Pwned, by Troy Hunt. StoutNook isn't affiliated with Have I Been Pwned.

Frequently asked questions

Is it safe to type my password into a leak checker?

This one never sends your password. Your browser hashes it with SHA-1 and sends only the first 5 of the 40 hash characters to Have I Been Pwned, which replies with every breached hash that starts the same way; the comparison happens on your device. Nothing is stored, logged or put in the page address, and the request carries no cookies. Be wary of checkers that send the whole password, or ask for your email address alongside it.

My password was found. Does that mean I was hacked?

Not necessarily. The count shows how often that exact password appears across breach data, often because other people chose the same one. But attackers feed these lists into automated login attempts on other sites, known as credential stuffing, so treat a found password as burned: change it everywhere you use it and turn on two-step verification.

My password wasn't found. Is it safe?

It means it isn't in the breach data Have I Been Pwned holds today. It could still be weak (a pet's name and a year may never have leaked, yet still be guessed in seconds), or it could be in a breach nobody has found yet. Check it with the password strength checker and use it on one site only.

How is this different from checking my email on Have I Been Pwned?

Checking an email address tells you which breaches included your account, which helps you see which sites to deal with. This tool checks the password itself, wherever it came from. For your email address, go to haveibeenpwned.com; we don't offer an email check.

Where does the list of breached passwords come from?

Pwned Passwords is run by security researcher Troy Hunt as part of Have I Been Pwned. It holds more than a billion unique passwords from data breaches, including passwords shared by law enforcement agencies such as the FBI and the UK's National Crime Agency. They're stored as hashes with a count, not linked to email addresses.

What does the number of times mean?

It's how many times that password appears across all the breach data Have I Been Pwned has processed. A large number means a popular password that attackers will try very early. Even a count of 1 means it's on lists that attackers use.

Is SHA-1 safe to use for this?

Yes, for this job. SHA-1's known weakness is that two different inputs can be crafted to share a hash, which matters for digital signatures and certificates. Here it's only a lookup key, and just 5 characters of it are sent. Sites should never store passwords with SHA-1, though; they should use a slow password hash such as bcrypt or Argon2.

More free tools