Free tool
Has your password been leaked?
Check whether a password has appeared in a known data breach, and how strong it is. It is checked without the password ever leaving your device.
Password health
Measure a password's strength and check it against known data breaches. The password is never stored anywhere.
Suggest a strong password
Generates a memorable, hard-to-guess password made of real words. Generation happens in your browser.
- 01
Type a password
It is scrambled into a fingerprint on your device before anything is sent.
- 02
Only five characters travel
We send the first five characters of that fingerprint. Roughly five hundred other passwords share them, so nobody can tell which one you meant.
- 03
Compare locally
The matching fingerprints come back and your device checks for yours.
Questions
→Do you see my password?
No. The password is never sent anywhere, not even in scrambled form. Only the first five characters of its fingerprint are sent to the Have I Been Pwned service, which cannot work out the rest.
→Does 'not found' mean the password is safe?
It means it does not appear in the breaches that service knows about. A short or guessable password is still weak, which is why we also show how strong it is.
→What should I do if it was found?
Stop using it everywhere. Choose a new, long and different password for each account, ideally from a password manager, and turn on two-step verification where you can.
→Should I type my real password into a website?
A good habit is not to type a password you use right now into any tool. Use this to test old passwords or ideas, and use a password manager's own breach check for the ones you use.