Private Breach Checker

How it works

Checks a password against the Have I Been Pwned Pwned Passwords collection using k-anonymity: your browser hashes the password with SHA-1 and sends only the first 5 of 40 hex characters; the match is done locally. The server and API accept only a SHA-1 hash or 5-character prefix, never a password.

• The password is hashed with SHA-1 (uppercase hex). Only the first 5 hex characters (20 bits) are sent to https://api.pwnedpasswords.com/range/<prefix>; the service returns every known hash suffix with that prefix (typically 800–1,000) and how often each appeared in breaches.
• Requests use the Add-Padding header, so the response contains random zero-count entries and its size reveals nothing; padding entries are ignored.
• With JavaScript on, hashing, the range request and the comparison all happen in your browser; our server is not involved. If your browser cannot reach the service directly, the page asks our API for the same 5-character range and still compares locally.
• The server path (no JavaScript, API, MCP) accepts only a 40-character SHA-1 hash or a 5-character prefix and rejects anything else, so a password can never be submitted by mistake. With a full hash, the server sees the hash (not the password) and sends only the prefix onwards.
• Not found does not prove a password is strong: it only means it is not in this breach corpus.

If a password appears in a breach, stop using it everywhere and change it. Use a password manager and unique passwords.

Sources

• Have I Been Pwned: Pwned Passwords API (range search, k-anonymity, padding) (Troy Hunt, Have I Been Pwned)
• Pwned Passwords data licence: Creative Commons Attribution 4.0 International (CC BY 4.0) (Have I Been Pwned)