🛡️ Stay safe online

Password Leak Checker

Check if your password or email address appeared in known data breaches — in seconds, and without ever giving your password away. View check history →

🔑 Password check

Your password is never saved anywhere — not even on this server.

✉️ Email check

See which breaches exposed an email address.

Email checks run on the free XposedOrNot API (no key needed, up to 25 checks per hour). The HaveIBeenPwned email route is not used, because it needs a paid API key.

🔒 How your password stays private

  1. Your password is hashed with SHA-1 right here, on this device.
  2. Only the first 5 characters of the hash are sent to HaveIBeenPwned.
  3. The server returns about 800 hash suffixes that share that prefix.
  4. The rest of your hash is matched locally, on this device — the server never learns which password you checked.

Example: the SHA-1 of password is 5BAA61E4… — only 5BAA6 is sent.

History on this site is temporary and resets when the server restarts. No password, full hash, or email address is ever saved.