/pwned — Password Breach Check
Check a password against the Have I Been Pwned "Pwned Passwords" database using k-anonymity — your full password, and even your full password hash, never leave this browser tab.
1
Hash locallyYour password is SHA-1 hashed right here, in your browser (WebCrypto). It is never sent anywhere.
→
2
Send 5 charactersOnly the first 5 hex characters of that hash go to our server — a prefix shared by hundreds of other hashes.
→
3
Server asks HIBPOur server asks Have I Been Pwned for every breached hash that shares that prefix, and hands the whole list back.
→
4
Match locallyYour browser compares your full hash against that list. Neither we nor HIBP ever learn what it was.
Have I Been Pwned provides this Pwned Passwords range API free of charge, without authentication or rate limits, expressly for integrations like this one.