breached.space

Passwords

Has this password leaked?

Checks a password against the ones Have I Been Pwned has collected from real breaches. Your browser hashes the password and sends only the first five characters of the hash.

What gets sent

When you check a password, each step below shows what your browser did.

  1. 1

    Your browser computes the SHA-1 hash of the password.

    —

  2. 2

    Only the first five characters go to api.pwnedpasswords.com/range/, with padding so the response size gives nothing away.

    —

  3. 3

    The API returns every leaked hash that starts with those five characters, and your browser looks for the rest of yours among them.

    —

Password data from Have I Been Pwned’s Pwned Passwords. Need a better one? Make a dice passphrase.