Password leak check

Checks whether a password appears in known data breaches. Only if you agree, part of its hash is sent to “Have I Been Pwned” (Pwned Passwords).

How it works (k-anonymity)

  • Your password never leaves the browser. It is hashed locally with SHA-1.
  • Only the first 5 characters of that hash (for example “5BAA6”) are sent to api.pwnedpasswords.com. Hundreds of passwords share that prefix, so the service cannot tell yours.
  • The reply is a list of all hash suffixes with that prefix. The comparison happens locally on your device.
  • The service does see your IP address and the time of the request. The request carries no cookie and no referrer.
  • Only this page may connect to the internet (its own Content-Security-Policy). All other pages of this app send nothing.