How can this be safe?
The check uses a method called k-anonymity. Your browser calculates a SHA-1 hash of your password, for example 5BAA6…, and asks Have I Been Pwned only for all known hashes that start with these first five characters. What comes back is a list of a few hundred entries. Your browser itself checks whether yours is among them. Neither we nor Have I Been Pwned learn your password or the full hash.
You can verify this in your browser’s network tab. Still, as a rule of thumb: don’t type your most important password, such as the one for your email account, anywhere you don’t have to.
My password was found. What now?
- Change the password everywhere you use it. Start with email, online banking and accounts with payment details.
- From now on, use a unique password for every account. A password manager makes this effortless.
- Turn on two-factor authentication wherever possible. Then a leaked password alone is no longer enough.
What makes a strong password
Length matters more than special characters. A random password with 16 characters is practically impossible to guess. Words, names, birth years and keyboard patterns such as qwerty, on the other hand, are what attackers try first. The easiest way to create a new password is our password generator.
Frequently asked questions: Password Checker
How do I check whether my password has been leaked?
Enter the password into the password checker. We compare it with the Have I Been Pwned database, which contains hundreds of millions of passwords from real data breaches. The password itself is never sent.
Is it safe to enter my password here?
Yes. Your browser calculates a fingerprint of the password and sends only the first five characters of it. The comparison happens on your device. Neither we nor Have I Been Pwned learn your password.
How long should a secure password be?
At least 12, better 16 random characters. Length matters more than special characters. Attackers try words, names, years and keyboard patterns first.