Check if a password has appeared in known data breaches using k-anonymity with the HIBP API hash prefix.
A password entered here is checked against Have I Been Pwned's Pwned Passwords corpus without sending the password itself. The browser computes its SHA-1 digest, submits only the first five hexadecimal characters, and compares the remaining characters with the returned candidates. The common surprise is that a positive result does not identify the breach, account, website, or date involved. It means HIBP has recorded that password digest in breach-derived data, so the password should be replaced wherever it is still used.
The browser computes the password's 40-character SHA-1 digest. The lookup request contains only its first five hexadecimal characters, not the plaintext password or complete digest. HIBP returns candidate suffixes belonging to hashes with that prefix, together with their prevalence counts. This k-anonymity design avoids directly disclosing which complete hash is being checked.
The browser compares the remaining 35 digest characters with the suffixes in the response. An exact match marks the password as found and links it to the count returned for that hash. No match means the current HIBP corpus did not return that digest. It does not measure length, randomness, reuse, resistance to guessing, or overall password strength.
No. This check sends the first five characters of the password's SHA-1 digest, while the plaintext password and remaining digest characters stay in the browser. HIBP returns many candidate suffixes sharing that prefix, and the browser performs the exact comparison. K-anonymity limits what the lookup reveals, but it does not turn an exposed password into a safe one.
No. Not found means only that this exact digest was absent from the returned HIBP data at the time of the check. A password can still be predictable, reused, recently exposed, or missing from the corpus. Use a unique, randomly generated password for each account and store it in a password manager when possible.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.