Skip to content
epitometool

Pwned password check

Security tools

Check password breach exposure using Have I Been Pwned k-anonymity range API.

Updated

Password breach check

Uses Have I Been Pwned k-anonymity API.

Only first 5 SHA-1 chars are sent; full password stays local.

Quick start

How to check breached passwords

Run HIBP k-anonymity check locally from password hash prefix.

  1. Step 1
    Enter password

    Type password to test against breach corpus.

  2. Step 2
    Run check

    Tool sends only SHA-1 prefix to HIBP API.

  3. Step 3
    Act on result

    If matched, rotate password and enable MFA.

In-depth guide

Pwned password check

Check whether a password appears in known breach corpora using HIBP's privacy-preserving k-anonymity API.

K-anonymity model

Only SHA-1 hash prefix (5 chars) is sent; suffix matching is performed locally in-browser.

Password policy use

Reject breached passwords during signup/reset and encourage passphrases with MFA.

When to use it vs alternatives

Use this tool for quick browser-based work when you need an answer or output immediately. Use a dedicated application or automated workflow when you need bulk processing, approvals, or repeatable production rules.

Step-by-step usage

  1. Enter password — Type password to test against breach corpus.
  2. Run check — Tool sends only SHA-1 prefix to HIBP API.
  3. Act on result — If matched, rotate password and enable MFA.

Common pitfalls

  • Check the result before replacing the original input.
  • Watch for unit, format, encoding, and browser memory limits on large inputs.
  • Keep a copy of important source material until the output is verified.

Frequently asked questions

Does this send my full password?

No. It sends only the first 5 characters of SHA-1 hash prefix (k-anonymity model).

What service is used?

Have I Been Pwned Pwned Passwords API over HTTPS.

Can I trust a zero result?

Zero means no known match in the corpus for that hash, not absolute future safety.

Keep exploring

More tools you'll like

Hand-picked utilities that pair well with the one you're on — all free, client-side, and zero-signup.

More security tools

See all →

Popular across EpitomeTool

Browse all →
Browse all 200+ free tools