How to Check If Your Password Was Leaked (Without Sending It Anywhere)

Typing a password into a random website to ask whether it is safe sounds like exactly the thing security advice tells you never to do. That instinct is correct, and it is worth keeping — but there is a specific method, called a k-anonymity range query, that makes the check genuinely safe, and you can verify it yourself in about ten seconds. Our password breach check uses it.

Quick answer

Your password is never sent. Your browser hashes it, sends five characters of that hash, and does the comparison locally.

How the check actually works

Take the password correcthorsebatterystaple. Its SHA-1 hash is:

BFD3617727EAB0E800E62A776C76381DEFBC4145

Only BFD36 is sent. Have I Been Pwned replies with every hash suffix it holds beginning with those five characters — for that prefix, 1,972 of them — each with the number of breach records containing it. Your browser then searches that list for its own suffix, 17727EAB0E800E62A776C76381DEFBC4145, and finds it appears 4,173 times.

In code, the whole thing is about six lines:

const hash = await sha1(password);              // in the browser
const prefix = hash.slice(0, 5);                // BFD36
const suffix = hash.slice(5);                   // everything else, stays here

const res  = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`);
const rows = await res.text();                  // ~2000 "SUFFIX:COUNT" lines

const hit = rows.split('\n').find(r => r.startsWith(suffix));

The service sees a request for a bucket of roughly two thousand passwords with no way to know which one interested you. It also cannot reverse any of them, because it only ever stored hashes.

Verify it yourself instead of trusting the page

This is the part most articles skip. You do not have to believe any of the above.

Open your browser's developer tools, go to the Network tab, and run the check. You should see exactly one outbound request, to a URL ending in five hexadecimal characters. Search the request for your password — it will not be there. Search it for the full hash — also absent.

If a page asking for your password does not survive that inspection, close it. The reason to trust this method is that it is checkable, not that someone promised.

What the numbers mean

A count is how many separate breach records contain that exact password. Scale matters more than the raw figure:

For scale: 123456 appears 210,461,208 times. password appears 52,372,427 times. A random twenty-character string appears zero times, as you would hope.

Why "not found" proves less than you think

This is the most misread result in password security.

A password absent from Have I Been Pwned has not been shown to be strong. It has only failed to appear in the breach data one organisation happens to hold. Three things follow:

• Unpublished breaches exist. Data sits in private hands for years before surfacing, if it ever does.
• Novelty is not strength. Invent a password nobody has used and it is absent by definition. Summer2026! is absent from plenty of lists and would still fall in seconds to a rule-based attack.
• The check knows nothing about your habits. Reusing a unique password across thirty sites is a serious exposure this test cannot see.

A found result is strong evidence to act. A not-found result is weak evidence of anything.

Where the data comes from

Have I Been Pwned is run by Troy Hunt and aggregates passwords from publicly disclosed breaches. Two design choices are worth knowing, because they are why the check can be free and anonymous at the same time.

It stores only hashes and counts — never the passwords themselves, and never the accounts they belonged to. There is no record connecting a password to a person, because that information was deliberately discarded.

And the range endpoint requires no account, no API key, and no authentication. There is nothing to log you against. That is unusual enough to be worth noticing: most services that answer a question about you want to know who is asking first.

If you would rather not type a password into any website at all, that position is defensible. The alternative needs no tool: change anything you reuse, and make the replacements long and unique. Reuse is the actual vulnerability, and diagnosing it requires nothing but honesty about your own habits.

What actually decides your exposure

Two things, neither measurable by this or any similar tool:

Length. Every additional character multiplies the work required to crack it. A long passphrase beats a short string with substitutions, and it is easier to remember.

Uniqueness. Reuse is what turns somebody else's breach into your problem. Credential stuffing works because people reuse; a password used in exactly one place limits any breach to that one account.

A password manager delivers both by default, which is why the advice is repeated so often. If you use one, this check is largely a curiosity. If you do not, it is the fastest way to find out whether something you rely on is already circulating.

What to do with a bad result

Change it wherever it is used, in this order: email first, since it can reset everything else; then banking and payments; then anything storing card details. Turn on two-factor authentication where offered — it is the single control that survives a leaked password.

And do not simply increment it. Summer2026! becoming Summer2027! is a transformation every cracking ruleset already applies.

Run the check on the password breach check page — nothing is transmitted and nothing is stored. While you are looking at exposure, the VPN leak test covers what your connection reveals, and the tracking status page covers what sites can see about your browser.