Free Password & Email Breach Checker
Check if your password has appeared in known data breaches and whether your email was hacked or leaked. Two checks, two different privacy models — both explained honestly below.
1. Password check
Your password is hashed in your browser. Only the first 5 characters of the hash leave your device — the password itself never touches the network.
How this works (k-anonymity)
When you submit, your browser computes the password's SHA-1 hash locally using the Web Crypto API. It then sends only the first 5 hash characters to the HaveIBeenPwned Pwned Passwords API, which replies with every breached-hash suffix sharing that prefix. Your browser matches the rest of your hash against that list locally. The API never learns your password or your full hash.
2. Email check
Unlike the password check, your email address is sent over HTTPS to the XposedOrNot API to run this lookup. That's how the check works — we won't claim otherwise.
Breach data: XposedOrNot (email check) & HaveIBeenPwned (password check)
Why check both?
Attackers use credential stuffing — taking username/password pairs from one breached site and testing them across thousands of other services. Knowing your email was breached tells you which accounts may be targeted; checking a password tells you whether that specific secret is already in an attacker's dictionary.
The password check uses k-anonymity: your browser computes the SHA-1 hash of your password, sends the first 5 characters to the HaveIBeenPwned API, and receives back all hashes in the database that share those 5 characters (typically around 800 entries). Your browser then matches the remaining 35 characters locally. The full hash — and the password itself — never leaves your browser.
Enterprise Security & NIST SP 800-63B Compliance
Section 5.1.1.2 of NIST Special Publication 800-63B explicitly recommends that authentication providers verify passwords against dictionaries of passwords obtained from previous breach corpuses. By checking credentials at registration or password change using k-anonymity, engineering teams prevent account takeover before an attacker can launch automated credential stuffing attacks.
Implementing breach checking in your own auth system?
Read our developer architecture guide: K-Anonymity in Password Breach Checking: Architecture & Developer Guide.
FAQ
Is it safe to type my real password here?
The password is hashed (SHA-1) in your browser before anything is sent, and only a 5-character hash prefix goes to the API. The API sees a prefix shared by hundreds of hashes and returns all matches; your browser picks out yours locally. Still, if you're cautious, test a password you're considering rather than your master password — healthy skepticism is good security hygiene.
What does "found in X breaches" actually mean?
It means that exact password has appeared X times across the breach databases HaveIBeenPwned has collected. A higher count means the password is more widely known and more likely to be tried by attackers in automated attacks. Any count above zero is a reason to stop using that password.
Why does the email check send my email to a server?
Checking whether your address appears in breach lists requires searching those lists, and there's no k-anonymity trick available for exact email lookup. Your address is sent over HTTPS to XposedOrNot, which runs the check. If that's not acceptable to you, skip the email check.
My email shows a breach for a service I never used. How?
Breach databases often contain emails collected from aggregated spam lists, combo lists, or third-party leaks, not just the affected service's own records. Your address may have been included without you having an account. Treat it as a signal that the address is circulating, and make sure you're not reusing passwords.
What should I do if my email appears in breaches?
Change the password on every listed service (and anywhere you reused it), enable two-factor authentication, and consider a password manager so every account gets a unique password. Do this for the breached services first — they're the known exposure points.