Skip to content
DuckINT

Password check

See whether a password has appeared in a data breach, without sending it anywhere: it is hashed in your browser and only the first 5 characters of the hash leave your device.
Data breaches

How your password stays private

  1. Your browser turns the password into a SHA-1 hash. The password itself is never sent.
  2. Only the first 5 characters of the hash are sent, which hundreds of different passwords share.
  3. Have I Been Pwned answers with every breached hash that starts with them, and your browser looks for the rest of its hash among them.

Nothing you type here is stored or logged. Data: Pwned Passwords