01How can this test be safe?
Sending a password to a website to know whether it leaked would be absurd. This test uses Have I Been Pwned's k-anonymity protocol: your browser computes the password's SHA-1 hash locally, then sends only its first 5 characters. The API returns the hundreds of compromised hashes starting the same way, and the final comparison happens in your browser. Nobody — not us, not HIBP — sees your password or even its full hash.
The Have I Been Pwned database, maintained by researcher Troy Hunt, aggregates over 900 million passwords from thousands of real breaches. It is what password managers and browsers query for their alerts. If your password is in there, consider it public — and generate a fresh one with our generator.
02Understanding the result
- Compromised
- The password appears verbatim in public breaches: attackers try it first (credential stuffing). Replace it everywhere, immediately.
- Occurrences
- How many times it appears across breaches. “123456” exceeds 40 million; even 2 or 3 occurrences are enough to condemn it.
- Not found
- Absent from known breaches — but not necessarily strong: “Password2026” can be leak-free and fall to a few minutes of brute force.
- k-anonymity
- The principle: ask for “all hashes starting with these 5 characters” instead of “this exact hash”. Your query is drowned among ~800 candidates, indistinguishable.
- SHA-1
- Used here as an identifier, not a protection: its cryptographic weakness has no bearing on this protocol, where the full hash never travels.
03Compromised password: what now?
Change it on every account where it is used — that is the real danger: attackers replay leaked email/password pairs on hundreds of sites (credential stuffing). Start with your primary email (it can reset everything else), then bank, social networks, shops.
Take the opportunity to switch to unique random passwords (our generator) stored in a manager, and enable two-factor authentication on sensitive accounts. A leaked password with 2FA enabled remains useless on its own.
04Frequently asked questions
Is it really safe to type my password here?
Yes, and you can verify it: open your browser's developer tools Network tab during the test. You will see a single request, to api.pwnedpasswords.com/range/XXXXX, where XXXXX is 5 hexadecimal characters — never your password, never its full hash. ItsMyIp's server is not contacted at all.
My password is not found: am I safe?
For the “leak” risk, yes. But absence from breaches does not measure strength: a short or predictable password falls to brute force even if it never leaked. The two tests are complementary: not found in breaches AND strong (16+ random characters) is the combination to aim for.
Where do the passwords in the HIBP database come from?
From real breaches, published or traded: databases of hacked sites (LinkedIn, Adobe, Dropbox…), combolists aggregated by cybercriminals, forum dumps. Troy Hunt collects and verifies them and only publishes the hashes — the Pwned Passwords set is even fully downloadable; it is a public service for security.
My password leaked on a site I never used — does it matter?
Yes, if you use that password elsewhere. The database does not say “your account leaked” but “this password is circulating”: anyone using it, on any site, is exposed to credential stuffing. That is the whole problem with reuse — and the reason for one unique password per service.
Why use SHA-1 when it is considered broken?
SHA-1 is broken for collisions (crafting two inputs with the same hash), which is irrelevant to this use: here it serves as a compact identifier to compare passwords against a database. The k-anonymity protocol only exposes 5 characters of the hash anyway — even a perfect hash would add nothing.