Password Leak Check
Privacy through k-anonymity: only the first 5 characters of the SHA-1 hash are sent to the API – never the password itself.
Is my password leaked?
The check reveals whether a password has already appeared in known data breaches – based on the “Have I Been Pwned” service. If a password shows up there, it should no longer be used anywhere.
- k-anonymity: Your password never leaves the browser. It is hashed locally with SHA-1; only the first 5 hash characters go to the API, which returns a list of matching suffixes.
- Match = unsafe: A found password is in attacker word lists and is practically worthless as protection.
- Tip: Use long, unique passwords – see our password and XKCD passphrase generators.