🧭 NavigatorsLab Tools ← All tools

🔐 Password Breach Checker

Type a password to see whether it has shown up in a known data breach. The password itself never leaves this tab — only the first 5 characters of its SHA-1 hash are sent, and the full hash never travels the network.

Press Enter to check. Nothing is stored — clearing the field erases it from memory.

How your password stays private

  1. Your browser hashes the password with SHA-1 — on your device, in milliseconds.
  2. Only the first 5 characters of that hash are sent to api.pwnedpasswords.com (the free Have I Been Pwned range API — no key, no account).
  3. The API returns every breached hash suffix starting with those 5 characters (typically hundreds to a few thousand candidates). Your browser compares them locally.
  4. The full password — and even the full hash — never leaves this tab. The 5-character prefix narrows the field to roughly 1 in 500 breached passwords: far too coarse to identify your password on its own, but it does tell anyone observing the request which 5 characters your hash starts with. That is the deliberate, minimal trade this check makes.

“Not found” means the password isn't in the public breach corpus — it doesn't guarantee the password is strong. Prefer a password manager and a unique password per site.