Password Breach Checker
Checks a password against the Have I Been Pwned Pwned Passwords database — over 900 million passwords seen in real data breaches — without ever sending the actual password anywhere. If it's on the list, it's not just "weak," it's actively being tried by credential-stuffing bots right now.
How this stays safe to actually use
This uses the k-anonymity model HIBP built the Pwned Passwords API around specifically for this use case. The password is hashed with SHA-1 entirely in your browser, and only the first 5 characters of that hash are sent to the API — never the password, never the full hash. The API responds with every breached hash suffix that shares that 5-character prefix, typically several hundred of them, and the match against your password's full hash happens locally in your browser. HIBP never learns which password you actually checked, and this page never sees the response until after the comparison already reduced it to a yes/no.
Why a match matters more than a normal strength check
A password can score well on a strength or entropy calculator — decent length, mixed character types — and still be a terrible choice if it's already sitting in a breach dataset. Entropy calculators measure theoretical randomness; this measures whether the password is on the actual list attackers use for credential-stuffing attacks, which is a much more concrete threat than brute-force guessing. A breached password is compromised regardless of how "strong" it looks, because it's not being guessed — it's being looked up.
What "not found" does and doesn't tell you
A clean result means this specific password hasn't appeared in the breach corpora HIBP has indexed — it does not mean the password is actually strong. correcthorsebatterystaple2 might not be in the database today and still be a bad choice if it's short, predictable, or reused elsewhere. Pair this check with an actual entropy or strength calculator, and — more importantly — never reuse a password across services regardless of what either check says, since reuse is what turns one breach into many.