Do you send my password to HIBP?

No. Your browser hashes the password with SHA-1 locally, sends only the first 5 hex characters of the hash to HIBP, and HIBP returns every matching suffix. Your browser then checks locally whether the full hash is in the response. This is called k-anonymity — HIBP never sees your full hash.

Why SHA-1 — isn't that broken?

SHA-1 is broken for digital signatures, not for this use case. HIBP uses SHA-1 because the public API was standardized on it years ago. For password storage, always use bcrypt/argon2 — never SHA-1.

What does "appeared in X breaches" mean?

It means this exact password has been leaked in public data breaches at least X times. Any count above 0 means you should change it everywhere you used it.

Password Leak Checker

k-anonymity lookup against the Have I Been Pwned database. Your password never leaves your browser in full.

Has this password been leaked?

Privacy promise: your password is hashed locally with SHA-1 and only the first 5 hex characters of the hash are sent to the Have I Been Pwned API (k-anonymity). HIBP never sees your full hash or password.