Check if a password has been exposed in data breaches using k-anonymity hash prefix matching via HIBP.
This tool checks whether a password has already surfaced in a known data breach. It hashes the password locally with SHA-1, then sends only the first five characters of that hash to the Have I Been Pwned Pwned Passwords API instead of the password itself. HIBP returns every hash suffix sharing that prefix along with how many times each was seen across breach dumps, and the tool matches the remaining characters locally in the browser. People are often surprised that a network request happens at all, since the k-anonymity design exists specifically so the full password, and the full hash, never leave the browser intact.
The password is hashed with SHA-1 entirely in the browser. Only the first five hex characters of that 40-character hash are sent to HIBP's range endpoint (for example /range/5BAA6); the full hash, and the password itself, never leave the browser. This mirrors the k-anonymity model HIBP publishes for Pwned Passwords, built so the service never receives enough of the hash to reconstruct which password was checked.
HIBP's response is a plain-text list of every hash suffix sharing the submitted prefix, each paired with a count of how many times it appeared in the breach corpora it indexes. The tool scans that list locally for the remaining 35 hash characters. A match reports the occurrence count; no match means the password isn't in HIBP's current dataset, not that no breach exists.
No. The password is hashed with SHA-1 in your browser, and only the first five characters of that hash are sent to HIBP - never the password, and never the full hash. The k-anonymity range API is built so HIBP cannot determine which exact password or hash you were checking from that partial prefix alone.
Because Pwned Passwords is built from strings seen across breach dumps, not from account-password pairs tied to you. If your string matches a common pattern someone else used elsewhere, such as a word plus digits, it will register as seen even though you personally never reused it.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.