Guide · 2 min read
How to check whether your password was leaked, without revealing it
You can check whether a password appears in known breaches without sending it to anyone. Here is how the technique works and what to do if yours shows up.
Last updated:
Millions of passwords leak from breached websites every year. If one of yours is on those lists, attackers will try it on other services with your email address. Knowing is useful; the catch is that checking seems to require typing your password into someone else’s site, which is exactly what you should not do.
How to check without revealing it
The technique is called k-anonymity, and it is used by the public service Have I Been Pwned, which holds hundreds of millions of leaked passwords. It works like this:
- Your browser computes the password’s SHA-1 fingerprint: a 40-character string that cannot be turned back into the password.
- It sends only the first 5 characters of that fingerprint.
- The service replies with every leaked fingerprint starting with those 5 characters: usually hundreds.
- Your browser looks for yours in that list, on your device.
The service never receives the password or its full fingerprint, and cannot tell which of the hundreds of results you cared about.
How to do it
Type the password into Audit passwords and press the breach-check button. It is the only part of the tool that uses the internet, and only when you ask. The strength analysis, by contrast, works offline.
If you would rather not type your password anywhere, even if it never leaves your browser, that is a reasonable position. In that case, check on Have I Been Pwned whether your email address appears in a breach: it tells you which services were involved and gives you an idea of which passwords to change.
If it shows up in a breach
- Change it everywhere you use it, starting with your email, which is the key to everything else: it can reset all the others.
- Do not use a variation. “Password2024” after “Password2023” is the first thing they try.
- Turn on two-step verification wherever you can, preferably with an authenticator app rather than SMS.
- Use a password manager so you can have a different password for every service without remembering them.
Why it matters even if you do not care about the breached site
Most account takeovers do not come from guessing passwords but from reusing them: a password leaked from a forgotten forum is automatically tried against banks, shops and email providers. One unique password per service turns a breach into a small problem instead of a chain reaction.