BREACH

Powered by HIBP Pwned Passwords

See if a password
is already exposed.

The full password never leaves your browser. We hash it locally and only send the first 5 SHA-1 characters to the HIBP Pwned Passwords API using the k-anonymity range model.

or

Privacy Notice

Passwords are hashed locally in your browser before any network request is made.
Only the first 5 SHA-1 characters are sent to HIBP using the k-anonymity range API.
Checks happen only after submit, not on every keystroke, which is safer than incremental searching.
Demo mode uses rotating sample passwords so people can explore the app without entering a real one.

Breach is an educational password exposure checker. It uses the free Have I Been Pwned Pwned Passwords API and does not send your full password to the service.