Has this password been leaked?
Checks the password against hundreds of millions of leaked passwords collected by Have I Been Pwned. The password itself never leaves your browser.
What gets sent
Your browser turns the password into a SHA-1 hash, then sends only the first 5 characters. Have I Been Pwned replies with every leaked hash starting with those 5 characters, hundreds of them, and your browser looks for a match privately. This is called k-anonymity.
- Your password
- Type a password above
- SHA-1 hash
- …
- Sent to HIBP
- …
Check a list of passwords
For IT admins auditing old credentials. Choose a .txt file with one password per line. It's read in your browser and never uploaded; each password is checked the same private way.
or drop the file here. Up to 2,000 lines.
| Line | Starts with | Result |
|---|
About Have I Been Pwned
Pwned Passwords is a free database of passwords exposed in real data breaches, run by security researcher Troy Hunt. Password managers and identity services use it to warn people about leaked passwords. NIST's digital identity guidelines tell services to check new passwords against exactly this kind of list.
MyPasswordCreator isn't affiliated with Have I Been Pwned. We use its public range API, which is licensed under CC BY 4.0.