Password Leaks Checker

How a check can be safe

Sending a password to a service to ask whether it has leaked would be self-defeating. The standard approach is k-anonymity: the password is hashed locally with SHA-1, the first five characters of the hash are sent, and the service returns every known hash suffix beginning with those five characters — typically several hundred. The match is performed on your device. The service learns five hex characters, which correspond to a bucket of many thousands of possible passwords, and never sees the password or its full hash.

What a hit actually means

It means that exact string appears in a corpus of breached credentials, not that your account was breached. A common password will appear millions of times because thousands of unrelated people chose it. The implication is the same either way: the string is in every attacker's wordlist, so it is tried within the first seconds of any credential-stuffing run regardless of how complex it looks.

A clean result proves less than it seems

Absence means the password is not in the corpora that service holds. Many breaches are never published, some circulate privately, and recent ones take time to surface. A unique random password will not appear in any breach list, but so will a weak password nobody happened to have used yet. Not-breached is not the same as strong.

Reuse is the reason this matters

Credential stuffing takes username and password pairs from one breach and replays them across hundreds of other services. It works because reuse is common, and it requires no skill and no vulnerability in the target. A breached password used on one site is a problem for that site; used on five, it is a problem for all five. This is the mechanism behind the large majority of account takeovers.

What to do about a hit

Change it everywhere it was used, not just where you noticed. Where the account supports multi-factor authentication, enable it, since that breaks credential stuffing even when the password is known. Then stop choosing passwords by hand: a manager generating unique random strings makes both the breach question and the reuse question permanently uninteresting.

Checking is a diagnostic, not a defence

The check tells you about the past. It cannot tell you whether a password will appear in tomorrow's dump. Unique passwords per site plus multi-factor authentication remove the need to keep asking.