How to Check If Your Password Was Breached

Data breaches expose billions of passwords every year. Here's how to check if yours is among them — without ever sending your actual password to anyone.

The problem with traditional breach checkers

Most websites that claim to check if your password was breached ask you to type it into a form. That form sends your password to their server. Even if the site is trustworthy, you're now trusting:

• Their server security
• Their logging practices
• Their employees and infrastructure
• That they won't be breached themselves

This is backwards. You shouldn't have to trust anyone with your password to check if it was leaked.

What is k-anonymity?

k-anonymity is a privacy-preserving technique that lets you check a password against a database without revealing the password itself. Here's how it works:

1. Your password is hashed using SHA-1 locally in your browser
2. Only the first 5 characters of the hash are sent to Have I Been Pwned's API
3. The API returns a list of hash suffixes that match those 5 characters
4. Your browser checks locally if your full hash appears in that list

The server never sees enough information to reconstruct your password. Even if the API is compromised or logging requests, the worst an attacker gets is that your password's hash starts with a certain prefix — which applies to millions of passwords.

Why use Presend's checker?

• 100% client-side — The SHA-1 hash is computed in your browser, not on our server
• No logging — We don't see your password or even the hash prefix
• Open source approach — The JavaScript is visible and auditable
• No account needed — Check as many passwords as you want, anonymously

What if my password was breached?

If the checker finds your password in a breach:

1. Change it immediately on every service where you use it
2. Never reuse passwords — Use a unique password for every account
3. Use a password manager — Tools like Bitwarden, 1Password, or KeePass generate and store strong, unique passwords
4. Enable 2FA — Two-factor authentication adds a critical second layer of security

How strong should my password be?

After checking for breaches, use our Password Strength Checker to evaluate your password's entropy and estimated crack time. Then generate a new one with our Password Generator.