Password breach checker
Check if a password appears in known data breaches — privately, without sending it.
How your password stays private
- Your browser turns the password into a SHA-1 hash — a 40-character fingerprint.
- Only the first 5 characters of that fingerprint are sent to Have I Been Pwned.
- The service returns every breached fingerprint starting with those 5 characters, padded with decoys.
- Your browser looks for a match privately. Nothing is saved, logged or cached.
Data from Have I Been Pwned — Pwned Passwords.
What leaves your device
The first 5 characters of your password’s SHA-1 hash — never the password itself.
About this page
What it shows
Attackers take passwords leaked from one website and try them on thousands of others. This checker tells you whether a password is already in those leaked lists, so you can stop using it before someone else does.
Why it’s safe to type your password here
Your browser turns the password into a SHA-1 hash — a fixed 40-character fingerprint — and sends only the first 5 characters to the Pwned Passwords service run by security researcher Troy Hunt, which is also used by password managers and government agencies. The service replies with every breached fingerprint that begins with those characters, mixed with decoy entries, and your browser checks for a match itself.
This technique is called k-anonymity: the service never learns your password or even its full fingerprint. SmartTools doesn’t store, log or cache the password, the hash or the result, and the password is cleared when you leave the page.
What to do with the result
If the password was found, change it on every account where you used it, starting with email and banking, and turn on two-step verification. If it wasn’t found, that only means it isn’t in known breaches — it could still be easy to guess. The best protection is a long, unique password for every account, stored in a password manager.
Questions
Can the website see my password?
No. The password is hashed on your device and only a 5-character prefix of the hash is sent. That prefix matches hundreds of different passwords, so it can’t identify yours.
Does “not found” mean my password is strong?
No. It only means it hasn’t appeared in the breaches the service knows about. Short or predictable passwords can still be guessed quickly.
Does it check my email address?
No. Checking whether an email appears in breaches needs an account key, which cannot be kept private in a website, so SmartTools doesn’t offer it. Use haveibeenpwned.com for that.
Should I type my real banking password?
The method is designed for exactly that and never sends your password. If you’d rather not, test a password you’re considering before you set it.