Free privacy tool
Has this password leaked?
Billions of passwords have appeared in data breaches, and attackers try those first. Check one here. The raw password never leaves your browser: only the first 5 characters of a local fingerprint are sent. Watch exactly what happens below.
What leaves your browser
Your password stays on this page
This page never sends, stores or logs the raw password. Everything below works on a local fingerprint of it.
Your browser computes a SHA-1 fingerprint
Locally, using the built-in Web Crypto API:
Only the first 5 characters are sent
One anonymous request goes out. Every password whose fingerprint starts the same way looks identical to yours:
GET api.pwnedpasswords.com/range/
The matching happens back here
The service returns hundreds of fingerprint endings for that prefix, padded so the response size reveals less. Your browser compares them locally.
Found in breaches
That means attackers already have it on their lists. It will be among the first guesses against any account that uses it. If it protects anything of yours, change it there, and don’t reuse it anywhere else. The fix that lasts: a unique password per account, kept in a manager you trust.
Where to keep 2FA backup codes and recovery keys safe →Not found in known breaches
It doesn’t appear in the breach data. That is a good sign, not a guarantee. Breaches surface constantly, and “not leaked yet” is no substitute for a password that is long, unique to one account, and backed by two-factor login.
Where to keep 2FA backup codes and recovery keys safe →Couldn’t reach the check service
Nothing was checked and nothing left your browser except the attempt. Try again in a moment.
How the k-anonymity trick works
Asking “has this password leaked?” the naive way means sending the password to someone, which is exactly what you should never do. The k-anonymity approach never sends the raw password. The service receives a 5-character hash prefix shared by many thousands of possible passwords, plus the ordinary metadata of any web request.
Your browser fingerprints the password with SHA-1, then sends only the first 5 of the 40 characters. Every password whose fingerprint begins the same way, hundreds of thousands of them, produces the identical request, so the service learns almost nothing about yours. It replies with every known-breached fingerprint ending for that prefix, and your browser does the actual matching here.
This page also asks for padded responses. That limits what reply sizes could hint at, but cannot remove it completely. Like any web request, the service still sees ordinary network metadata such as your IP address. What it never sees is the password, or enough of its hash to identify it.
Some things shouldn’t live in a notes app.
2FA backup codes, recovery keys, the passwords that unlock everything else. Sealby keeps them encrypted on your device, readable by no one but you.
iPhone & iPad · iOS 17+ · Free