OneTaskBy Tim King · Updated
Pwned Password Checker
k-Anonymity Range Lookup Sends Only a Five-Character SHA-1 Prefix Off Your Device
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the Pwned Password Checker works
This pwned password checker tells you whether a password has appeared in a known data breach, and how many times. Your password is hashed in your browser and only the first five characters of that hash are sent, so neither this site nor the breach service ever sees the password itself.
How the pwned password checker keeps your password private
The tool computes the SHA-1 hash of what you type, then sends just the first five hex characters to the Pwned Passwords range API run by Have I Been Pwned. The service replies with every breached hash suffix that starts with those five characters, usually several hundred of them, and the tool looks for your suffix in that list on your own device. This technique is called k-anonymity: the service cannot tell which of the hundreds of matching hashes you were checking. The request also asks for padded responses, so the size of the reply does not give the answer away either.
What the count means
The number is how many times that exact password appears across the breach corpus. A password seen even once is in the word lists attackers try first, so treat any match as unusable. A result of zero does not make a password strong; it only means it has not leaked yet. Pair this check with a strength check.
FAQ
Is it safe to type a real password here?
Yes, as far as it can be. Only five hex characters of a SHA-1 hash are sent, and they match hundreds of unrelated passwords. Nothing is stored or logged by this page. If you are still uneasy, check a password you are about to retire rather than one you plan to keep.
My password was found. What should I do?
Change it everywhere you have used it, starting with email and banking, and use a different password for each site from now on. A password manager makes that practical. Turn on two-factor authentication where it is offered, so a leaked password alone is not enough.
Why SHA-1 when it is considered broken?
SHA-1 is weak against deliberately crafted collisions, which does not matter here. It is only used as a lookup key into the breach list, and that list is published in SHA-1 form. Your password is never stored anywhere using this hash, so its weakness does not put you at risk.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Password Strength Checker
Estimate a password's entropy, crack time and weak patterns.
Password Generator
Strong random passwords generated in your own browser.
Passphrase Generator
Diceware passphrases from the EFF wordlist, generated locally.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 digests from text.
Account Security Checklist
A prioritised checklist to secure email, bank, social and work accounts.