Check if Your Password Has Been Breached

Find out if a password has shown up in known data breaches — instantly, and privately. It's checked right on your device, so we never see it or store it.

Password security

We never see or store your password

Your password is scrambled on your own device before anything is sent, and only a tiny, anonymous fragment of that scrambled value ever leaves your browser — never the password itself. Nothing you type is saved, logged, or shared. The check happens in the moment and is gone as soon as you leave.

What this tool does

It tells you whether a password has appeared in a known data breach — one of the real password leaks that attackers collect and reuse. This isn't a strength meter: even a long, complicated-looking password is risky once it has leaked, because attackers already have it and no longer need to guess.

Why it matters

When a company is breached, the passwords stored there often spill out. Attackers take those leaked email-and-password pairs and try them automatically across other sites — banking, email, work accounts — at huge scale. If you've reused a password, a single leak can put every account that shares it at risk. That's why reuse is the most common cause of accounts being taken over.

What to do if your password shows up

Change it everywhere you've used it — right away.
Give every account its own unique password (don't just tweak the old one).
Turn on multi-factor authentication wherever it's offered.

Stronger password habits

Use a long passphrase — length matters more than complicated symbols.
Never reuse a password across accounts.
Let a password manager create and remember them for you.
Turn on multi-factor authentication everywhere it's offered.
Re-check important passwords now and then — new breaches surface all the time.

Frequently asked questions

Yes. It's scrambled on your own device and the password itself is never sent to us or saved anywhere. Only a small, anonymous fragment is used to run the check.

No. It means this exact password has appeared in a known breach somewhere, so it's on lists attackers use. Your account may be fine — but change the password everywhere you've used it, just to be safe.

A strength checker guesses how hard a password is to crack. This checks something more urgent: whether it has already leaked. A password can look strong and still be unsafe if it's in a breach.

Leaked passwords are often published months or years later, and most people are never told directly. Checking is how you find out early — before someone uses it.

Check a password

Enter a password — it's checked privately, right in your browser.