Home › Developer Tools › Pwned Password Checker

Pwned Password Checker

Find out whether a password is in a public list of passwords exposed in data breaches. The password is hashed in your browser and only a 5-character hash prefix is sent, so neither the password nor its full hash ever leaves your device.

Last updated: October 24, 2026

Password to check

Private by design: your password is hashed with SHA-1 in your browser. Only the first 5 characters of the hash are sent; the match is found on your device.

Enter a password and press Check password.

What exactly is sent? (k-anonymity details)

SHA-1 hash of your password: —
Sent to the API (prefix): —
Kept in your browser (suffix): —
Request: —
Hashes returned for that prefix: —

How to use the Pwned Password Checker

Type or paste the password you want to check. Use Show to verify what you typed.
Press Check password. Your browser computes the SHA-1 hash locally.
Only the first 5 hash characters are sent; the service returns all leaked hash suffixes with that prefix.
Read the result: a breach count means the password is burned and should be replaced everywhere.
Open the details panel to see exactly what was sent.

How the check works

Your browser computes the SHA-1 hash of the password, a 40-character hexadecimal string. For the word password it is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8.
Only the first 5 characters (5BAA6) are sent: GET https://api.pwnedpasswords.com/range/5BAA6.
The service returns every leaked hash suffix that begins with that prefix, each with a count, typically several hundred lines such as 1E4C9B93F3F0682250B6CF8331B7EE68FD8:….
Your browser looks for the remaining 35 characters in that list. A match means the password has been exposed; its count shows how often.

Because the server only ever sees a 5-character prefix shared by many unrelated passwords, it cannot learn what you typed. This privacy model is called k-anonymity.

What to do if a password is pwned

Situation	What to do
You use it on any account	Change it now, starting with email, banking and accounts that can reset others.
You reused it on several sites	Give each site its own unique password; attackers try leaked passwords everywhere.
You are choosing a new password	Use a password manager or a passphrase of 4-6 random words, then check it here.
An important account supports it	Turn on two-factor authentication so a password alone is not enough.

Tips for passwords that stay safe

Length beats complexity: a 16-character passphrase is far harder to guess than an 8-character mix of symbols.
Avoid names, dates, keyboard patterns and common substitutions like P@ssw0rd; they are in every guessing list.
Never reuse passwords. A breach on one site then cannot unlock your other accounts.
Developers can use the same range API at sign-up to reject breached passwords, as recommended by NIST SP 800-63B.

Breach data: Pwned Passwords by Have I Been Pwned, licensed under Creative Commons Attribution 4.0.

Frequently asked questions

Is it safe to type my password here?

The password itself is never sent. Your browser computes its SHA-1 hash and sends only the first 5 hexadecimal characters. Hundreds of different leaked hashes share that prefix, and the comparison with the returned list happens on your device, so the service cannot tell which password, if any, you checked.

What is k-anonymity?

It is a technique where a query is mixed in with many others that look the same. Here, a 5-character prefix matches about a million possible hash values (16^5 = 1,048,576 prefixes split the whole list), so the server only learns a bucket, never the password or its full hash.

What does the breach count mean?

It is how many times that exact password appeared across the breach data collected in the Pwned Passwords list. Even a count of 1 means it is known to attackers, who try such lists first in credential-stuffing and guessing attacks.

My password was not found. Is it strong?

Not necessarily. Not being in the list only means it has not been seen in the breaches collected. A short or predictable password can still be guessed quickly. Use 12 or more characters, or a passphrase of several random words, and never reuse it.

Does this check my email address or accounts?

No. It checks a password only, not whether a particular account was breached. A breach count tells you the password is unsafe for any account.

Where does the data come from?

The results come from the free Pwned Passwords range API run by Have I Been Pwned (data licensed under CC BY 4.0). The check needs an internet connection; this page never stores what you type.

Are all the tools on FreeToolCabin tested for quality and accuracy?

Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.

Related tools

Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Password GeneratorCreate strong passwords and passphrases.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SRI Hash GeneratorCreate Subresource Integrity hashes (sha256/384/512) and ready <script> or <link> tags.SSH Key GeneratorGenerate Ed25519 or RSA SSH key pairs in your browser: OpenSSH public key plus private key.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.CSR DecoderDecode a PEM certificate signing request: subject, SANs, key size, signature and CA readiness checks.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SAML DecoderDecode SAMLRequest and SAMLResponse messages to readable XML, attributes and validity times.SSL Certificate ConverterConvert SSL certificates and keys between PEM, DER, PFX/P12 and P7B in your browser.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.

See all 65 Encoders, Hashes & Crypto →