Exposed? — Check if your passwords are in a breach

Check a password

We hash it on your device and send only the first 5 characters of that hash. Your actual password never leaves this page.

Password to check

Privacy by design. This uses the Have I Been Pwned k-anonymity range API: your password is SHA-1 hashed in your browser and only a 5-character prefix is ever transmitted. No password, email, or result is stored or logged.

Was my email in a breach?

Checking an email address safely requires Have I Been Pwned's authenticated service. We won't ask you to paste your email here where it could be logged — instead, check it directly and privately at the source.

If you're exposed, do these three things

Change it everywhere. If a password shows up in a breach, treat it as public. Change it on every account that used it.
Stop reusing. Give every account its own password — a password manager makes this painless.
Turn on two-factor. Even a breached password can't get in alone if a second step is required.