Has my password leaked?
Type a password to see how many times it appears in known data breaches. It is checked in your browser and never sent anywhere, not even to us.
How we check without seeing your password
Step 1: your browser makes a fingerprint
Your browser runs the password through SHA-1, which turns it into a 40-character code called a hash. The same password always gives the same hash, but you can't turn the hash back into the password.
Step 2: only the first 5 characters are sent
We send just the first 5 characters of that hash to the Pwned Passwords range API (opens in a new tab). Hundreds of leaked passwords share any 5-character start, so the service can't tell which one you typed. This is called k-anonymity: you hide in a crowd of possible matches.
Step 3: the match happens on this page
The service sends back every hash suffix that starts with your 5 characters, along with how often each was seen in breaches. We also ask it to pad the reply with fake entries, so even the size of the answer gives nothing away. Your browser then looks for your full hash in that list. Nothing about the result is sent anywhere.
Why a leaked password matters
Attackers take passwords from old breaches and try them on other sites, betting that people reuse them. That's why NIST's digital identity guidelines (SP 800-63B) (opens in a new tab) tell services to compare new passwords against a blocklist of commonly used and compromised passwords. This tool lets you run that same check yourself.
For a business, one reused password can open email, Microsoft 365 and remote access. Our access control service puts MFA and password policies in place, and dark web monitoring alerts you when staff credentials turn up in new leaks.
Breach data from Have I Been Pwned's Pwned Passwords (opens in a new tab), by Troy Hunt. GlobeVM isn't affiliated with Have I Been Pwned.
Questions about the password check
Is it safe to type my real password here?
Yes. Your password is turned into a SHA-1 hash inside your browser, and only the first 5 of its 40 characters are sent to the Pwned Passwords service. That short prefix matches hundreds of different passwords, so nobody, including GlobeVM and Have I Been Pwned, can tell which one you typed. If you'd still rather not, test a password you've retired or a close variation.
My password wasn't found. Does that mean it's strong?
No. It only means it isn't in the breach data Have I Been Pwned has collected. A short or predictable password can still be guessed. Use a long, unique password for each account, ideally made by a password manager, and turn on multi-factor sign-in.
Why would my password be in a breach if I've never been hacked?
The count is for the password, not for you. If anyone anywhere used the same password on a site that was breached, it shows up. Common passwords appear millions of times. Either way, attackers try those passwords first, so a found password isn't safe to use.
Does this check my email address too?
No. This tool checks passwords only. To see if your email address was in a breach, search it on haveibeenpwned.com. For ongoing alerts across your whole team, ask us about dark web monitoring.
Protect every login, not just one
Get a free IT assessment. We check how your team signs in, where MFA is missing, and what to fix first. No cost and no obligation.