How can I check if my password has leaked?

Use a checker that hashes the password locally and performs a k-anonymity range search, such as Sealby’s password leak check. It sends only the first five characters of a SHA-1 fingerprint, receives many possible suffixes, and compares the full fingerprint in your browser.

My password was in a breach — what first?

Change it first on every account where you reused it, starting with email, your password manager, banking and any account that can reset others. Use a different unique password for each one, then review sessions and turn on 2FA or a passkey where available.

Is it safe to type my password into a checker?

Only if you can verify how the checker works. Sealby’s checker keeps the password and full hash in the browser; one five-character hash prefix goes to the Pwned Passwords range API. It also requests padded results and waits for you to submit rather than searching as you type.

Does a clean result mean my password is strong?

No. It only means the exact password was not found in the checker’s current data. A short pattern, personal fact, slight variation or password reused on a site that has not been breached can still be weak.

Has your password leaked? How to check and what to do first

Key takeaways

Leaked passwords usually come from breached websites and stolen account databases, not from this check and not necessarily from your device.

Sealby hashes the complete password in your browser and sends only the first five characters of that fingerprint to Have I Been Pwned.

A match means the password is in known attack data. The biggest risk is every other account where the same password was reused.

Fix reuse first, then move to unique manager-generated passwords or long passphrases, then add 2FA or passkeys.

A clean result is useful but not proof that a password is strong, unique or unknown to an attacker.

Where leaked passwords come from

A website stores enough information to recognise your password when you sign in. Good sites store a slow salted hash, not the password itself. Breaches still expose password databases, and bad implementations, old algorithms or weak passwords let attackers recover many of the original values. Those values are collected into cracking lists and tried elsewhere.

A match therefore says something about the password, not the health of the device in your hand. It does not prove malware read your keyboard or that the account you are checking was the breached site. It may have come from a different service years ago.

How checking works without revealing the password

Sealby’s checker computes a SHA-1 fingerprint of the complete password inside your browser. SHA-1 is used here only as the lookup format required by the Pwned Passwords database, not to store or protect your password. The page sends the first five hexadecimal characters of that fingerprint — never the password and never the full fingerprint.

The service returns hundreds of fingerprint endings that share that prefix, padded to make response sizes less revealing. Your browser compares the real ending locally and ignores padding entries. This is called k-anonymity: the server sees a crowd of possible passwords, while your device knows which complete fingerprint to look for.

What a match honestly means

A match means the exact password fingerprint is present in known compromised-password data. Attackers can put that password near the front of a guessing list. It does not tell you who used it, which breach exposed it, or whether a particular account has already been opened.

The danger concentrates where you reused it. Automated credential-stuffing tools try a leaked email-and-password pair across mail, shops, social networks and financial services. One old breach becomes several account takeovers because the password travelled.

Fix it in this order

1. Remove the reuse. Change the password everywhere it appears. Start with email and any account that can reset other accounts, then financial services, work, social accounts and shops. Sign out unknown sessions while you are there.

2. Make every replacement unique. A password manager can generate and remember random passwords. For secrets you must type or remember, use several randomly chosen words from the passphrase generator. Do not make one strong password and reuse it.

3. Add a second barrier. Turn on 2FA, preferably an authenticator or hardware key rather than SMS where the service offers a choice. A passkey is even better where supported because it is unique to the site and resists phishing.

What a clean result cannot prove

No breach corpus contains every stolen password. A site may not know it was breached, an attacker may keep data private, and a weak password can be guessed without ever appearing in a leak. “Not found” is one useful signal, not a strength certificate.

Judge the full setup: unique per site, long or randomly generated, stored safely, and backed by 2FA or passkeys. If you want to see why length and storage algorithms change guessing time, read how brute-force attacks work.

Has your password leaked? How to check — and what it actually means