Password Breach Check

This page does not perform a live lookup — it explains how breach checking works and why the method matters.

Important: Never type your real, current password into any website claiming to check it — including this one. The only safe way to use breach-checking services is via a method called k-anonymity range queries, explained below.

What is a breach database?

When a website is attacked and its user database stolen, attackers often publish the data on forums or sell it. These "breach dumps" typically contain email addresses paired with passwords — sometimes in plain text, sometimes as hashed values. Researchers and security companies collect these dumps and index them so that individuals can check whether their credentials appear in one.

The problem with naive checking

The obvious approach — type your password into a box, send it to a server, get a yes/no answer — is fundamentally insecure. It requires you to trust the operator of that server completely. A malicious or compromised site could log every password it receives. Even a trustworthy site creates a record of your password in transit and in their logs.

The safe method: k-anonymity range queries

The Have I Been Pwned service (and compatible implementations) solves this problem with a technique called k-anonymity, proposed by security researcher Troy Hunt. Here is how it works:

  1. Your device hashes the password locally using the SHA-1 algorithm. The hash is a fixed-length fingerprint — it cannot be reversed to recover the original password.
  2. Only the first five characters of that hash are sent to the API. For example, if your full hash is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8, only 5BAA6 is transmitted.
  3. The API returns every hash in the database that begins with those five characters — typically hundreds of entries. Your device downloads this list.
  4. Your device then checks whether the remainder of your hash appears anywhere in the list. The full password hash never leaves your device, and the server never knows which specific entry you were looking for.

Why five characters is enough privacy

A SHA-1 hash is 40 hexadecimal characters. The first five narrow the database down to roughly 500–1,000 entries out of billions. The server knows you are looking for something with that prefix, but the prefix alone tells it almost nothing — many millions of different passwords could produce any given five-character prefix. This property — that the server learns as little as possible — is what "k-anonymity" formalises.

What to do if your password appears in a breach

  • Change it immediately on every service where you have used it. Reuse is what makes breach exposure dangerous.
  • Enable two-factor authentication on affected accounts if you have not already. A leaked password alone cannot access an account with a hardware key or authenticator app.
  • Generate a new, unique password for each site. Use the generator on this site or a password manager's built-in tool.
  • Check the email address too. A breached password is often paired with your email; the email address is also searchable on breach-checking services without the k-anonymity concern, since email addresses are not secrets in the same way.

Red flags to avoid

Be cautious of any service that:

  • Asks you to type your actual password into a form (rather than computing a hash client-side)
  • Does not clearly explain the privacy model it uses
  • Requires you to create an account before showing results
  • Is not a well-known, independently audited service

The k-anonymity model used by established services is open and well-documented. If a site cannot explain precisely how it protects your input, do not use it.