Has My Password Been Leaked?
Check whether a password has turned up in a known data breach. Your password never leaves your device: it’s scrambled into a code in your browser, and only the first 5 characters of that code are used to look it up.
Private by design: the password is hashed with SHA-1 in your browser. Only the first 5 characters of the hash are sent to Have I Been Pwned, and the match happens on your device. Nothing is stored or logged. Leak data from Have I Been Pwned (Pwned Passwords, CC BY 4.0).
How to use it
- Type or paste a password into the box. Press Show if you want to check what you typed.
- Press Check password (or Enter).
- If it’s been leaked, you’ll see how many times it appears in known data breaches. If not, you’ll see Not found in any known leak.
- Press Clear and check another when you’re done. Nothing is saved, and the box empties when you leave the page.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
Is it safe to type my password here?
Yes, and here’s exactly why. Your password never leaves your device. When you press Check, your browser turns it into a 40-character code called a SHA-1 hash. A hash works one way only: the same password always gives the same code, but you can’t turn the code back into the password.
Only the first 5 characters of that hash are sent to Have I Been Pwned. Their service replies with the hundreds of leaked password hashes that start with the same 5 characters, and your browser compares the rest of the code against that list on your own device. Have I Been Pwned never sees your password or even its full hash, so it can’t tell which one you were checking. This method is called k-anonymity, and it’s the same one used by password managers such as 1Password and Bitwarden.
We also ask for random padding in the reply, so the size of the response can’t give anything away. Catpool doesn’t store, log or send the password anywhere else. You can check this yourself: the only network request the tool makes is to api.pwnedpasswords.com/range/ followed by 5 characters.
That said, a good habit is never to type a password into a site you don’t trust. If you’d rather not check a password you’re still using, change it first and then check the old one.
What does “leaked” mean?
When a website is hacked, its list of users’ passwords is often stolen and later shared online. Have I Been Pwned, run by security researcher Troy Hunt, collects passwords from these breaches into a searchable list of more than a billion real passwords. Criminals use exactly the same lists in credential stuffing attacks: they try every leaked password, and the email addresses that go with them, on banks, shops and email accounts.
So if your password is on the list, it doesn’t necessarily mean your account was hacked. It means someone, somewhere, used the same password and it leaked. Either way, attackers will try it, so it isn’t safe to use any more.
If your password has been leaked
- Change it everywhere you use it, starting with your email account, because email can be used to reset everything else.
- Use a different password for every site, so one leak can’t unlock the rest. A password manager makes this easy.
- Make strong new passwords with our Password Generator, or use three random words.
- Turn on two-step verification (2FA) on important accounts, so a password alone isn’t enough to get in.
- Watch out for follow-up scams. After a breach, scammers often send convincing emails or texts. Our Text X-Ray can help you spot them.
FAQ
“Not found” means my password is strong, right?
Not quite. It means the password hasn’t appeared in a known breach. A short or obvious password like a name and a year can still be guessed quickly. Aim for at least 12 characters, and don’t reuse it.
Can I check my email address here?
This tool checks passwords only. To see if your email address has been caught up in a breach, search for it at haveibeenpwned.com.
Who runs Have I Been Pwned?
Have I Been Pwned is a free service created by Troy Hunt that’s trusted by governments, banks and password managers around the world. The breached password data used here comes from Pwned Passwords and is used under the Creative Commons Attribution 4.0 licence.
It says it couldn’t reach Have I Been Pwned. Why?
The check needs an internet connection. Some ad blockers and privacy extensions block the request, so try pausing them for this page. Nothing is sent unless the check runs.
Related: Catpool home, Security, Password Generator, QR X-Ray, Link X-Ray, Text X-Ray, Photo X-Ray.
