Password Breach Checker
Check if a password has appeared in a known data breach. Your password is hashed locally — only 5 characters of that hash are ever sent, never enough to identify it.
Your password is never sent to our serversHow it works: your password is hashed with SHA-1 in your browser. Only the first 5 characters of that hash are sent to the breach database (k-anonymity) — never your actual password, and never the full hash.
Frequently asked questions
Is it safe to enter my real password?
Yes. The tool uses k-anonymity: only the first 5 characters of your password's hash are sent to the Have I Been Pwned API. Your actual password never leaves your device.
What is k-anonymity?
K-anonymity is a privacy technique where only a partial hash prefix is sent to the server. The server returns a list of matching hashes, and your browser checks locally if your full hash is in that list.
Where does the breach data come from?
The tool queries the Have I Been Pwned (HIBP) database maintained by Troy Hunt, which contains billions of real passwords exposed in known data breaches.
What should I do if my password is breached?
Change it immediately on all services where you use it. Use a unique password for each service and consider using a password manager to generate strong, unique passwords.
Does this tool store my password?
No. Your password is hashed in your browser, and only the first 5 characters of that hash are sent, directly from your browser to the Have I Been Pwned API. Nothing is stored or logged, and Presend's servers never see your password or its hash.