Password Breach Check
Find out if a password has appeared in a data breach, using Have I Been Pwned. Your password never leaves your browser.
Attackers don't guess passwords one letter at a time: they try the billions of real passwords leaked in past data breaches first ("credential stuffing"). If yours is on that list, it will fall in seconds no matter how complex it looks. This check uses Troy Hunt's Have I Been Pwned Pwned Passwords list, the same one many sign-up forms and password managers use.
Your password never leaves your browser. Only 5 characters of its hash are sent, and only to Have I Been Pwned.
How it works (k-anonymity): your browser turns the password into a SHA-1 hash, for example
5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. It sends just the first 5 characters (5BAA6) to
Have I Been Pwned, which replies with every leaked hash starting with those 5 characters: usually around two
thousand of them, padded with decoys so even the reply size gives nothing away. Your browser then looks for the rest of your hash
in that list. tclient.com never sees the password or the hash, and Have I Been Pwned can't tell which of those
hashes was yours. To confirm, open your browser's developer tools (F12), go to the Network tab and
run a check: the only request is to api.pwnedpasswords.com/range/ plus 5 characters.