Check if a password was breached

Site owners and system administrators can check a domain or access before changing settings. Look up your password in published breaches, without ever sending it.

Look up your password in published breaches, without ever sending it. Use it free in your browser with no account required.

How to use

Enter the password you want to check into the field, without sharing it with anyone else.
Run the check to compare the value locally with the breach data included in the tool.
Read the result to see whether that value appears in the breaches known to the tool.
If the password is flagged, change it on the affected services and choose a unique replacement.
Erase the field to check another password without keeping the previous one visible.

Example

A realistic use is checking an old password before reusing it on a new site. If the tool flags it as present in a breach, treat it as compromised and replace it everywhere it has been used, including accounts you rarely visit.

Limits and formats

The tool can only report breaches that are present in the data it has.
A password that is not flagged is not automatically safe.
This check does not replace a password manager or two-factor authentication.
Only enter a real password if you accept the risk of the device you are using.
Use a unique password for each important account to limit damage if a breach occurs.

Where processing happens

The check runs inside your browser. The password you type stays on your device and is not sent to any remote service. No value is stored by the tool.

Frequently asked questions

How can it check my password without sending it?

The comparison is performed locally in the browser using the breach data available in the tool. Your value does not need to be transmitted for the check to work.

What should I do if my password appears in a breach?

Change it immediately on every site where it is used, then choose a different password for each service. Turn on two-factor authentication whenever the service offers it.

Does a negative result mean I am protected?

No, no match only means that this value does not appear in the data checked. It may still be weak or may have leaked elsewhere without being listed in that source.