Sovereign Suite · one check is free

PWNCHECK

Billions of passwords have leaked in data breaches, and if yours is one of them, attackers already have it. PWNCHECK tells you if a password has shown up in a known breach, without the password ever leaving your device. It scrambles the password here, sends only a tiny fragment of that scramble to the breach database, and does the matching in your browser. The database never learns your password or even which fragment is yours.

How your password stays private: your password is hashed on your device, and only the first 5 characters of that hash are sent. The breach service returns hundreds of possible matches for those 5 characters and never knows which one is yours, or whether any of them is. This is the same k-anonymity method security professionals use.

Check a password

show

Check a list

PWNCHECK runs in your browser and never sends or stores your password; it sends only a 5-character fragment of a one-way hash, which cannot be reversed. A match means the password has appeared in a breach and should never be used again anywhere. No match does not prove a password is strong, only that it has not been seen in these breaches. If a password you use shows up here, change it, and consider a password manager and two-factor authentication.