Check whether a password has appeared in known data breaches — against the HaveIBeenPwned database of billions of leaked passwords. Your password never leaves your browser: it's hashed locally, and only the first 5 characters of the hash are sent (the k-anonymity method), which is mathematically insufficient to reveal what you typed.
Powered by the open HaveIBeenPwned Pwned Passwords API using k-anonymity. We never see, send, or store your password.
Leaked vs weak — you need both checks
A password can be strong but leaked (someone else used it and it got breached), or clean but weak. Run both: this leak check, plus our in-browser strength checker. Then fix the root cause with the passphrase method — and remember where passwords must never be typed.