Tools / Everyday
Has your password leaked?
Type a password and see whether it appeared in past data breaches and how often — without it leaving your phone: its fingerprint is made in the browser, only the first 5 characters are sent, and the match happens on your device.
How do we check without seeing it?
Your browser computes the SHA-1 fingerprint, sends only its first 5 characters to Have I Been Pwned, gets back all fingerprints starting with them (hundreds), and looks for yours locally. Neither the password nor the full fingerprint leaves.
- A different password for every site — use a password manager.
- Turn on two-step verification for email, bank and WhatsApp.
- A long phrase beats a short complex word.
How to use it
- Type the password.
- Tap “Check”.
- If it's leaked, change it everywhere you use it.
Questions
Is it safe to type it here?
Yes. The password never leaves your device: its SHA-1 is computed in the browser, only the first 5 characters are sent, and hundreds of matching hashes come back to compare locally — the method big browsers use.
Clean means strong?
Not necessarily — only that it's not in known leaks. Use long, unique passwords.
Where's the data from?
Have I Been Pwned, with hundreds of millions of leaked passwords.