Has it leaked?

How the password check keeps the password private#

The check uses a technique called k-anonymity, offered by the Pwned Passwords service of Have I Been Pwned. Nothing that could reveal your password ever leaves the browser:

1. Your browser computes the SHA-1 hash of the password.
2. It sends only the first five characters of that hash to Have I Been Pwned.
3. The service replies with every known hash that starts with those five characters, a few hundred of them, without knowing which one you meant.
4. Your browser compares the rest of your hash against that list, on your device.

The service never sees the password or the full hash, and this site never sees either. The privacy policy describes exactly what leaves your browser.

What the result means#

• Not in any known breach. The password has not turned up in the dumps the service holds. It is not a promise that it is strong: a short, guessable password can be absent from every list and still fall in seconds.
• Seen N times. The number of times the password appears across breach corpora. Any hit means the password is on the wordlists attackers try first. Stop using it everywhere, whatever the count.

The email check#

The email tab sends the address you type to the Have I Been Pwned API, which returns the breaches it appears in: the date, how many accounts, and the kinds of data exposed. The address is forwarded and forgotten, never stored or logged here. It is limited to a handful of checks a minute to keep the service available.

If you find something#

1. Change the password on the affected account, and everywhere else you used it.
2. Give every account its own password. Generate them with the password generator and keep them in a password manager.
3. Turn on two-factor authentication, starting with your email, because email resets everything else.
4. Expect phishing that uses details from the breach. A message that knows your old password or your address is not proof that it is genuine.