Tools

Pwned check

Check a password against Have I Been Pwned without sending the password itself.

How this works

  1. The password is hashed in this browser with SHA-1. It is never written to disk or sent in full.
  2. Only the first five hex characters of that hash go to api.pwnedpasswords.com/range/….
  3. HIBP replies with a list of matching suffixes. This page compares the rest of the hash locally.