How do I check if my password has been in a data breach?

Type the password into Password to check and click Check for breaches. The result says whether it appears in Have I Been Pwned's breached password list and how many times. Use Show to reveal what you typed.

Is my password sent to Have I Been Pwned?

No. Your browser hashes it with SHA-1 using Web Crypto, and only the first 5 characters of the hash go to api.pwnedpasswords.com. The match is then checked locally against the returned list.

What does it mean if my password is not found in any breach?

It only means the password is absent from Have I Been Pwned's corpus. It does not prove the password is strong. A long, unique password you do not reuse is still the safer choice.

Why do I get an error saying the breach database could not be reached?

This is the one tool that needs a network request. The error appears when api.pwnedpasswords.com is blocked, offline or returns an HTTP error. Check your connection or ad blocker and try again.

Can the tool generate a safe replacement password?

Yes. Click Generate a strong replacement. It creates a 20-character random password locally with crypto.getRandomValues, checks it against the breach list the same way, and shows it with a Copy button.

Yes. Every tool is free to use, with no account and no credit card. The work runs on your device rather than on our servers, which is what keeps it free to run.

Does it work on mobile?

Yes. It runs in current mobile browsers on iOS and Android, with nothing to install.

🛡️

Free Password Breach Checker

Check whether a password has appeared in known data breaches via Have I Been Pwned — using k-anonymity, so the password is hashed locally and only a 5-character hash prefix is ever sent. The password itself never leaves your browser.

Runs in your browserNo sign-up, no pop-upsNo login requiredFree foreverk-anonymitypassword never sent

Password to check

Your password is never sent anywhere. It's hashed with SHA-1 in your browser, and only the first 5 characters of that hash are sent to the Have I Been Pwned range API. The server returns every breached hash sharing that prefix, and the match is checked locally — this is the k-anonymity model, so the service never learns your password or its full hash.

This check makes one network request — it sends the 5-character hash prefix to api.pwnedpasswords.com. Your password and its full hash are never sent.

How It Works

Checks a password against Have I Been Pwned's database of billions of breached passwords — without ever sending the password anywhere. It uses the k-anonymity model: only the first 5 characters of the password's SHA-1 hash leave your browser.

1
The password is hashed locally
Your password is SHA-1 hashed in your browser with the Web Crypto API. The password itself never leaves your device.
2
Only a 5-character prefix is sent
The first 5 hex characters of the hash are sent to the Have I Been Pwned range API, which returns every breached hash sharing that prefix.
3
The match is checked in your browser
Your browser looks for your hash's suffix in that list and shows how many times (if any) the password has appeared in breaches. The service never learns which one was yours.

This is the only LibraTool tool that makes a network request, and even then your password and its full hash never leave your browser — only a 5-character hash prefix does.

Related Tools

🔒

Password Strength Checker

Check how strong your password is with entropy analysis, crack time estimates, and a detailed checklist of requirements. Runs entirely in your browser.

Try it

🌐

WebRTC IP Leak Test

Check whether WebRTC is leaking your local network address or your real public IP around your VPN. Runs a genuine peer connection in your browser using public STUN servers — nothing is uploaded.

Try it

🔓

Unlock PDF

Remove the password from a PDF you can open, or lift its print, copy and edit restrictions. Several files at once. Runs in your browser; nothing is uploaded.

Try itFiles stay local