Check whether a password already appears in the collections attackers use for credential stuffing. The password never leaves this device.
How this check works
Your password is never sent anywhere. It is hashed in your browser with SHA-1, and only the first five characters of that hash leave your device. The range service returns every hash it holds beginning with those five characters — several hundred of them — and the comparison happens locally. The service cannot tell which of those hashes you were asking about, and it never sees the password.
This is called k-anonymity. You can verify it yourself: open your browser developer tools, switch to the Network tab, and run a check. The only outbound request is to a URL ending in five hexadecimal characters.
A result of “not found” means this exact string is absent from the breach corpora indexed by the source below. It does not mean the password is strong, that it is unique to you, or that it has never been exposed somewhere nobody has catalogued. A result of “found” is unambiguous: retire the password.
Sources
- Password hash range API and the underlying corpus: Pwned Passwords, queried live at each check.
- Federal guidance on responding to exposed credentials: Federal Trade Commission.
Data Breach Radar is not affiliated with the operators of the services above. We use their public APIs and identify them as the source.