Free Password & Email Breach Checker
Check if your password has appeared in known data breaches and whether your email was hacked or leaked. Two checks, two different privacy models — both explained honestly below.
1. Password check
Your password is hashed in your browser. Only the first 5 characters of the hash leave your device — the password itself never touches the network.
How this works (k-anonymity)
When you submit, your browser computes the password's SHA-1 hash locally using the Web Crypto API. It then sends only the first 5 hash characters to the HaveIBeenPwned Pwned Passwords API, which replies with every breached-hash suffix sharing that prefix. Your browser matches the rest of your hash against that list locally. The API never learns your password or your full hash.
2. Email check
Unlike the password check, your email address is sent over HTTPS to the XposedOrNot API to run this lookup. That's how the check works — we won't claim otherwise.
Breach data: XposedOrNot (email check) & HaveIBeenPwned (password check)
What is a data breach, and why should you care?
A data breach happens when information is taken from a system without permission — usually a company's user database being hacked and leaked online. Breaches have exposed billions of accounts over the past decade: email addresses, passwords (often poorly hashed or in plain text), names, phone numbers, and sometimes payment details. Once your credentials appear in a breach, they get added to lists that attackers use for credential stuffing — automatically trying your leaked email and password combination on hundreds of other sites.
This tool checks your exposure two ways. The password check compares the SHA-1 hash of your password against the HaveIBeenPwned Pwned Passwords corpus of over 600 million passwords collected from real breaches. The email check asks XposedOrNot which known breach databases contain your email address, so you can see exactly which services leaked your data and change those passwords first.
The password check is designed around a privacy technique called k-anonymity: your
browser hashes the password, sends only a 5-character prefix of that hash, and matches
the remainder locally against the API's response. Because thousands of hashes share
any given prefix, the API can't determine which password you checked. Your password
never leaves your browser — that's not marketing copy, it's how the code works, and
you can verify it in your browser's network tab: you'll see a request to
api.pwnedpasswords.com/range/XXXXX and nothing containing your password.
One honest caveat: these checks only cover known breaches. A "not found" result means your password or email isn't in the public datasets these APIs index — it is not a guarantee you're safe. Use unique passwords per site and a password manager regardless of what this tool reports.
FAQ
Is it safe to type my real password here?
The password is hashed (SHA-1) in your browser before anything is sent, and only a 5-character hash prefix goes to the API. The API sees a prefix shared by hundreds of hashes and returns all matches; your browser picks out yours locally. Still, if you're cautious, test a password you're considering rather than your master password — healthy skepticism is good security hygiene.
What does "found in X breaches" actually mean?
It means that exact password has appeared X times across the breach databases HaveIBeenPwned has collected. A higher count means the password is more widely known and more likely to be tried by attackers in automated attacks. Any count above zero is a reason to stop using that password.
Why does the email check send my email to a server?
Checking whether your address appears in breach lists requires searching those lists, and there's no k-anonymity trick available for exact email lookup. Your address is sent over HTTPS to XposedOrNot, which runs the check. If that's not acceptable to you, skip the email check.
My email shows a breach for a service I never used. How?
Breach databases often contain emails collected from aggregated spam lists, combo lists, or third-party leaks, not just the affected service's own records. Your address may have been included without you having an account. Treat it as a signal that the address is circulating, and make sure you're not reusing passwords.
What should I do if my email appears in breaches?
Change the password on every listed service (and anywhere you reused it), enable two-factor authentication, and consider a password manager so every account gets a unique password. Do this for the breached services first — they're the known exposure points.