Has your password been in a breach?
Type a password below and check it against a public dataset of passwords seen in known breaches. The check runs client-side using a k-anonymity scheme, so the full password and its full hash never leave your browser. See the panel below for exactly what does.
What leaves this page
Only the first 5 characters of the SHA-1 hash of your password. Your password itself is never sent, and nothing is stored. The hashing runs locally in your browser with the Web Crypto API, and only that 5-character prefix is sent to the public Pwned Passwords range API, which returns hundreds of candidate hashes for your browser to compare against on its own.
You do not have to take my word for it: open your browser developer tools, watch the Network tab, and run a check. You will see a single request to api.pwnedpasswords.com with a 5-character path, and nothing else. The exact hashing and matching code is published as a public gist.
What you are trusting
Two things, and nothing more. First, that the code on this page does what it says and does not send your password anywhere else, which you can confirm in the Network tab and in the source linked above. Second, that a 5-character hash prefix reaching Cloudflare and Pwned Passwords reveals essentially nothing: that prefix is shared by hundreds of unrelated passwords, so the service never sees your password or its full hash.
One limit worth stating plainly: if the check comes back clear, it only means the password is not in this dataset, which is not a guarantee that it is safe. And this checks a password against a breach corpus, not whether any of your own accounts were breached.
Password data via the Pwned Passwords range API.