Check whether a password appears in known data breaches — without revealing it. Your password is hashed on your device and only the first 5 characters of the hash are ever sent (the k-anonymity method), so not even the breach database learns what you typed.
Your password is SHA-1 hashed in your browser. Only the first 5 characters of that hash are sent to the Have I Been Pwned public range API, which returns ~800 candidate hash suffixes. Your browser checks for a match locally. The full password — and even its full hash — never leaves your device. This "k-anonymity" design is the industry-standard way to do breach checks safely.
If your password shows up: change it everywhere you've used it, and this is your sign to get a password manager. Data by Have I Been Pwned. More tools: bvtech.org/tools.
