Password Breach Checker
This checks whether a password appears in known breach corpora using Have I Been Pwned's k-anonymity API: your browser hashes the password with SHA-1 and sends only the first 5 hex characters, so the password and full hash never leave your device.
What is k-anonymity?
Instead of sending the secret, the client sends a short prefix and the server returns every hash that starts with it. Your browser matches the rest locally, so the server learns the prefix, never the password. SHA-1 here is only a lookup index, not a security claim.
The request goes to api.pwnedpasswords.com with a five-character hash prefix. No account or key is needed.
This tool runs entirely in your browser. Your inputs and files are processed locally and are never sent to or stored on Kinetikatech servers.
Related pages
Server problem? Hacked site? Slow website?
Critical issues answered within 30 minutes, 24 hours a day, 7 days a week.