Password Breach Checker
Check if your password has appeared in known data breaches.
Examples
Build a k-anonymity range lookup
Password: passwordSHA-1: 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
Range prefix sent: 5BAA6
Suffix retained locally: 1E4C9B93F3F0682250B6CF8331B7EE68FD8The component sends only the first five hash characters and retains the rest for a client-side suffix comparison.
Match a suffix in a range response
Requested suffix: 1E4C9B93F3F0682250B6CF8331B7EE68FD8
Response:
1E4C9B93F3F0682250B6CF8331B7EE68FD8:3303003
ABCDEF1234567890ABCDEF1234567890AB:1Breach count: 3303003
State: breachedparseHibpResponse returns the integer after the matching suffix, so any positive count selects the breached state.
About this tool
Password Breach Checker uses the browser's Web Crypto API to calculate an uppercase SHA-1 digest of the entered password. It splits the 40-character digest into a five-character prefix and a 35-character suffix; the password and complete digest are not included in the range request.
The component requests /api/hibp/<prefix> and compares the locally retained suffix with each SUFFIX:COUNT line in the returned range. A matching line produces the breach count, no match produces the not-found state, and a failed request produces an explicit connection error. This is the k-anonymity range pattern rather than a full-password lookup.
SHA-1 here is only a compatibility lookup key for the breach corpus, not a password-storage recommendation. A not-found result means the value was absent from the returned known-breach range at check time; it does not establish that the password is strong, unique, or safe to reuse.
How to use
Enter the password locally
Type the password into the masked field. Use the visibility control only when shoulder-surfing is not a concern, and press Enter or click Check Password.
Understand the range request
The browser hashes the value with SHA-1 and sends only the first five hexadecimal characters to the application's HIBP range endpoint; the remaining suffix stays in the browser for matching.
Interpret the result
A red result reports the matching breach count, a green result says the suffix was not found in the returned data, and a yellow result means the range request failed.
Act on a match
Replace a breached password everywhere it was used, choose a unique value for each account, and store credentials in a reputable password manager.
Use cases
Checking a password before adoption
Look for known exposure before choosing a password, while still evaluating length, uniqueness, and randomness separately.
Responding to an account incident
Check a suspected credential and use a positive result as a prompt to rotate it anywhere it was reused.
Demonstrating k-anonymity
Show how a five-character hash prefix can request a candidate range without transmitting the complete password hash.
Validating an integration response
Use known suffix/count lines to confirm that a range proxy and client parser preserve counts and line endings correctly.
Common mistakes
Mistake:Assuming the password or full SHA-1 hash is sent to the breach service.
Fix:The component sends only the first five hash characters to the range endpoint and compares the returned candidates with the remaining suffix locally.
Mistake:Treating Not found in known breaches as a guarantee that the password is strong.
Fix:Use a long, randomly generated, unique password anyway. Absence from a known corpus says nothing about guessing resistance or reuse elsewhere.
Mistake:Using SHA-1 to store application passwords because this checker calculates it.
Fix:SHA-1 is used only to address the breach range. Store passwords with a dedicated adaptive password-hashing scheme and an appropriate work factor.
Mistake:Interpreting a network error as a clean result.
Fix:Retry after connectivity or API availability is restored. The component has a separate error state and does not classify a failed request as safe.
Frequently asked questions
Related guides
References & standards
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.