{"id":213,"date":"2026-08-21T14:09:09","date_gmt":"2026-08-21T14:09:09","guid":{"rendered":"https:\/\/netguide.io\/tools\/password-leak-check\/"},"modified":"2026-08-21T14:09:09","modified_gmt":"2026-08-21T14:09:09","slug":"password-leak-check","status":"publish","type":"post","link":"https:\/\/netguide.io\/tools\/en\/password-leak-check\/","title":{"rendered":"Password Leak Check"},"content":{"rendered":"<div id=\"netgu-104192559\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<style>\n.wp-pwn-container { max-width:100%; background:#fff; padding:20px; border:1px solid #ddd; border-radius:10px; font-family:-apple-system, sans-serif; color:#333; }\n.wp-pwn-title { margin:0 0 15px 0; color:#2271b1; font-size:1.4rem; }\n.wp-pwn-grid { display:grid; grid-template-columns:repeat(auto-fit, minmax(140px, 1fr)); gap:12px; margin-bottom:10px; }\n.wp-pwn-input-group label { display:block; font-size:11px; font-weight:bold; margin-bottom:4px; text-transform:uppercase; color:#666; }\n.wp-pwn-input-group input, .wp-pwn-input-group select { width:100%; padding:8px; border:1px solid #ccc; border-radius:4px; box-sizing:border-box; }\n.wp-pwn-checkbox-group { margin:15px 0; font-size:12px; display:flex; align-items:center; gap:8px; color:#666; }\n.wp-pwn-note { font-size:12px; color:#666; margin-top:12px; min-height:1em; }\n.wp-pwn-warn { color:#d63638; font-weight:bold; }\n.wp-pwn-results { margin-top:20px; border-top:2px solid #eee; padding-top:15px; }\n.wp-pwn-res-item { display:flex; justify-content:space-between; margin-bottom:6px; font-size:14px; gap:10px; }\n.wp-pwn-total { font-weight:bold; font-size:18px; color:#2271b1; margin:10px 0; padding:5px 0; border-top:1px solid #eee; border-bottom:1px solid #eee; }\n.wp-pwn-val { color:#2271b1; font-weight:bold; }\n.wp-pwn-out { width:100%; box-sizing:border-box; padding:10px; border:1px solid #ccc; border-radius:4px; font-family:monospace; font-size:13px; word-break:break-all; background:#f7f7f7; margin-top:6px; }\n.wp-pwn-btn { background:#2271b1; color:#fff; border:none; padding:9px 14px; border-radius:4px; cursor:pointer; font-size:13px; margin-top:10px; }\n<\/style><style>.wp-pwn-out{padding:12px;border-radius:6px;font-size:15px;font-weight:bold;margin-top:12px;background:#f9f9f9;border:1px solid #eee;min-height:1em;}.wp-pwn-out.ok{background:#e7f7ed;color:#2e7d32;border-color:#a5d6a7;}.wp-pwn-out.bad{background:#fdf2f2;color:#d32f2f;border-color:#ef9a9a;}<\/style><script>window.wpPwnL = {\"waiting\":\"Enter a password and check\u2026\",\"checking\":\"Checking\u2026\",\"found\":\"Found in breaches\",\"change\":\"do not use this password\",\"safe\":\"\u2713 Not found in any known breach\",\"err\":\"Error\"};<\/script>\n<div class=\"wp-pwn-container\">\n  <h3 class=\"wp-pwn-title\">Password Leak Check<\/h3>\n  <div class=\"wp-pwn-input-group\"><label>Password<\/label><input type=\"text\" id=\"pwn-in\" placeholder=\"Enter password\u2026\" onkeydown=\"pwnKey(event)\"><\/div>\n  <button class=\"wp-pwn-btn\" onclick=\"checkPwn()\" style=\"margin-top:8px;\">Check<\/button>\n  <div id=\"pwn-out\" class=\"wp-pwn-out\"><\/div>\n  <div class=\"wp-pwn-note\">Privacy through k-anonymity: only the first 5 characters of the SHA-1 hash are sent to the API \u2013 never the password itself.<\/div>\n<\/div>\n<script>\nasync function checkPwn(){\n  var pw=document.getElementById('pwn-in').value; var st=document.getElementById('pwn-out'); var L=window.wpPwnL||{};\n  if(!pw){ st.className='wp-pwn-out'; st.innerText=L.waiting||''; return; }\n  st.className='wp-pwn-out'; st.innerText=L.checking||'...';\n  try{\n    var buf=await crypto.subtle.digest('SHA-1', new TextEncoder().encode(pw));\n    var arr=Array.prototype.slice.call(new Uint8Array(buf));\n    var hex=arr.map(function(b){ var s=b.toString(16); return (s.length===1?'0':'')+s; }).join('').toUpperCase();\n    var prefix=hex.slice(0,5), suffix=hex.slice(5);\n    var res=await fetch('https:\/\/api.pwnedpasswords.com\/range\/'+prefix);\n    if(!res.ok) throw new Error('HTTP '+res.status);\n    var text=await res.text(); var lines=text.split('\\n'); var count=0;\n    for(var i=0;i<lines.length;i++){ var pp=lines[i].split(':'); if(pp[0].trim()===suffix){ count=parseInt(pp[1],10)||0; break; } }\n    if(count>0){ st.className='wp-pwn-out bad'; st.innerText=(L.found||'Found in breaches')+': '+count.toLocaleString('en-US')+'x \\u2013 '+(L.change||'do not use this password'); }\n    else { st.className='wp-pwn-out ok'; st.innerText=L.safe||'Not found in known breaches'; }\n  }catch(e){ st.className='wp-pwn-out bad'; st.innerText=(L.err||'Error')+': '+e.message; }\n}\nfunction pwnKey(ev){ if(ev.key==='Enter') checkPwn(); }\n<\/script>\n\n\n<div id=\"netgu-2171491522\"><script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- NetGuide.io-After-Widget-Tools -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-6258556257245998\"\r\n     data-ad-slot=\"5175852350\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Is my password leaked?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The check reveals whether a password has already appeared in known data breaches \u2013 based on the &#8220;Have I Been Pwned&#8221; service. If a password shows up there, it should no longer be used anywhere.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>k-anonymity:<\/strong> Your password never leaves the browser. It is hashed locally with SHA-1; only the first 5 hash characters go to the API, which returns a list of matching suffixes.<\/li>\n\n\n<li><strong>Match = unsafe:<\/strong> A found password is in attacker word lists and is practically worthless as protection.<\/li>\n\n\n<li><strong>Tip:<\/strong> Use long, unique passwords \u2013 see our password and XKCD passphrase generators.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Related tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"\/tools\/en\/password-generator\/\">Password Generator<\/a><\/li>\n\n\n<li><a href=\"\/tools\/en\/password-entropy-calculator\/\">Password Entropy Calculator<\/a><\/li>\n<\/ul>\n\n\n<div id=\"netgu-19085144\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Check whether a password appears in known data breaches \u2013 via the Have I Been Pwned API with k-anonymity. The password is never sent.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[131],"tags":[],"class_list":["post-213","post","type-post","status-publish","format-standard","hentry","category-validator-en"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/posts\/213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/comments?post=213"}],"version-history":[{"count":0,"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/posts\/213\/revisions"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/media?parent=213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/categories?post=213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/tools\/wp-json\/wp\/v2\/tags?post=213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}