Has your password been breached? PWNCHECK

How the password stays yours

The password is never sent anywhere, and that is not a promise to take on trust; it is a property of the method, and you can watch it in your browser's network panel.

1. Your browser takes the SHA-1 of what you typed, on your device.
2. It sends the first five characters of that hash and nothing else.
3. The answer is every hash suffix that begins with those five characters (several hundred of them, from unrelated passwords) along with how many times each has appeared in a breach.
4. Your browser looks for your suffix in that list. The lookup happens on your device, so nothing at the other end learns which of the several hundred you were asking about.

This is called k-anonymity, and the request goes through this site rather than straight to the breach database, so no third party sees your address or which page you were on. Five characters of a SHA-1 match roughly eight hundred real-world passwords, so neither the database nor this site can tell which one you meant.

Reading the number

A count is how many times that exact password has appeared in a breach corpus. It is a fact about the password, not about you: a count of nine million means nine million accounts somewhere used the same string, not that yours is among them.

Any count above zero means stop using it, everywhere, including on accounts you think do not matter. Credential stuffing works by trying breached pairs against every service in turn, and the account that does not matter is usually the one that recovers the account that does.

Zero does not mean safe. It means the password is not in this corpus. A password can be absent and still be guessable in seconds: anything short, anything that is a word with a number after it, anything built from your own life. PHRASE scores a password on how long it would actually take to guess, which is the question this tool does not answer.

Should you type a password you still use?

Worth thinking about rather than being told. The method means the password does not leave your device, and you can verify that as you use it. But the strongest habit is not to type a live password into any web page at all, including this one, and it costs you nothing here: change the password first, then check the old one. If it turns out to have been breached you have already fixed it, and if it has not you have lost nothing but a minute.