Has your password already been stolen?

Type a password below and we will check it against roughly 15 billion credentials that have leaked in real data breaches. It takes about a second. We never see the password, we never ask for your email, and there is nothing to sign up for.

Why this is safe, in plain English

  1. Your browser scrambles the password into a 40 character fingerprint. That happens on your own device, in JavaScript you can read by viewing the source of this page.
  2. Only the first five characters of that fingerprint are sent out, for example 5BAA6. Those five characters are shared by hundreds of thousands of completely different passwords.
  3. The breach database sends back every leaked fingerprint starting with those five characters, usually about a thousand of them. The matching happens here, in your browser.
  4. So nobody on the other end can tell which of those thousand you were asking about, and your actual password never leaves this page.

The lookup goes directly from your browser to Have I Been Pwned, the breach database security teams use. It does not pass through our servers, so we could not log it even if we wanted to. Nothing happens until you press the button, so no keystroke is ever sent.

Being straight with you about the one thing we do record: our analytics counts that a check was run and whether it found a match, the same way every page on this site counts visits. The password, its fingerprint and even those five characters are not part of that, and there is no account or email to attach it to. You can verify all of this yourself in your browser's network tab.

Nothing is sent until you press Check it. If you would rather not type a password you actually use, test it with an old one, or with a variation, and the answer will still tell you whether that pattern is in the lists.

If it came back found, here is what actually happens next

Nobody is targeting you personally

Attackers load leaked email and password pairs into software that tries them against hundreds of sites automatically. It is called credential stuffing. You are not singled out, you are simply in the list.

The reused one is the dangerous one

A leaked password only matters where it still works. If the same password opens your email, your bank and your accounting software, one old breach at a shopping site hands over all three.

Email first, always

Your email inbox is the master key, because every other account will happily send a password reset to it. Fix email before anything else, and turn on two factor there.

Length beats cleverness

Four unrelated words you can picture beat a short password full of symbols. It is longer, far harder to crack, and you can actually remember it.

Your password is one door. How many others are standing open?

This check looks at one credential. Our free website scan looks at the parts of your business an attacker or a regulator can see from outside: missing security headers, an exposed email setup that lets anyone send mail as you, and the accessibility and privacy gaps that carry real fines in Canada right now.

SCAN MY WEBSITE FREE WHAT COULD I BE FINED FOR?

Questions people ask before they type

Are you going to store this or email me about it?
No. There is no email field on this page and no form that submits anywhere, so there is no way for us to contact you about it. Your browser talks to the breach database directly, and the password never reaches us. The only thing recorded is an anonymous tally of how many checks run and how many find a match, which is how we know whether this page is worth keeping.
Why does it ask for the password at all, rather than my email address?
Because checking a password can be done without revealing it, and checking an email address cannot. Email lookups require handing your address to somebody. We would rather give you the check that costs you nothing.
It said my password was not found. Am I safe?
It means that password has not turned up in these breach lists. That is good, but it is not the same as strong. Something like Toronto2026! has probably never leaked and would still be guessed almost immediately, because it follows a pattern attackers try first. The notes under your result cover that separately.
Where does the breach data come from?
Have I Been Pwned, run by security researcher Troy Hunt. It is the same dataset used inside Google Chrome, 1Password and government security teams.
What should I use instead?
A password manager generating a different long random password for every site, and two factor authentication on email and banking at minimum. The hard part is not choosing good passwords, it is remembering sixty of them, which is exactly the job a manager does.

This tool reports whether a password appears in a public collection of breached credentials. A result of not found means it is absent from that collection, not that it is secure, and a found result does not mean any specific account of yours has been accessed. This is general information, not a security audit of your systems.