Password Breach Check
Find out whether a password has appeared in a known data breach. Your password is never sent anywhere: your browser sends only the first five characters of a one-way hash to the Have I Been Pwned "Pwned Passwords" service and does the final comparison itself.
How the check protects your privacy
- Your browser turns the password into a SHA-1 hash, a fixed-length fingerprint that cannot be reversed.
- It sends only the first five characters of that hash to the Pwned Passwords service (run by Have I Been Pwned), together with a request that the reply be padded so its size does not hint at the result.
- The service returns the endings of every known breached hash that starts with those five characters, with a count for each.
- Your browser looks for the rest of your hash in that list. The match happens on your device.
This design is called k-anonymity. Neither your password nor your full hash leaves your device, and KeyGuard Pro does not receive or store anything you type. The request goes directly from your browser to Have I Been Pwned, which has its own privacy policy.
What the result means
- Found: the password has appeared in leaked data and attackers test such passwords first. Stop using it everywhere and replace it with a random one from our generator.
- Not found: it did not appear in the known data. That does not make it strong, because a weak password may simply not have leaked yet. Use a long random password and a password manager.
If a password you use turns up, read what to do after a data breach. As a precaution, avoid testing your most important passwords on any website; test an older or similar one, or change the important one anyway.