Check if passwords or credentials have appeared in public data breaches. Uses mathematical k-Anonymity with 5-character SHA-1 prefix hashing so your full password never leaves your browser.
Runs entirely in your browser
Billions of credentials have leaked in public data breaches, and attackers routinely try those known passwords against other accounts. Checking whether a password has appeared in a breach tells you whether it is already burned and should never be used again. The challenge is doing that check without handing your password to anyone — and this tool solves it with a technique called k-Anonymity.
Here is how it stays private: your password is hashed with SHA-1 in your browser, and only the first five characters of that hash are sent to query a breach database. The service returns every leaked hash sharing that five-character prefix — hundreds of them — and the final match is done locally in your browser. The server never learns your full hash, let alone your password, yet you still get a definitive answer.
If a password shows up as breached, stop using it everywhere immediately and replace it with a unique, randomly generated one. A clean result is reassuring but not a guarantee of overall security, so pair strong unique passwords with two-factor authentication on important accounts.
TechToolsHQ is an independent, reader-supported tech platform. If this free tool saved you time, solved a problem, or helped your workflow, consider supporting our work. Your support helps us keep our utilities 100% free, private, and ad-free for everyone.