Is your password already in a breach?
Attackers do not guess passwords letter by letter — they replay billions of passwords leaked in past breaches. This tool estimates how long a modern cracking rig would need to break your password and checks it against the Have I Been Pwned database of real leaks, using a method that never reveals the password to anyone.
· The password never leaves your browser. The breach check sends only the first 5 characters of its SHA-1 hash to Have I Been Pwned, which cannot be reversed into the password.
How the breach check stays private
Your password is hashed with SHA-1 locally in your browser. Only the first 5 characters of that hash are sent to the Have I Been Pwned API, which returns every leaked hash starting with those characters — typically about 800 of them. Your browser checks the list locally. The service never sees your password, its full hash, or even whether it matched. This k-anonymity design is why security professionals trust the check.
What the numbers mean
Entropy
- A measure of how many guesses a password could require
- Length multiplied by the variety of characters used
- Under 36 bits falls quickly; 60+ holds up offline
Crack estimate
- Assumes an offline attacker at 10 billion guesses/second
- A leaked database is attacked at this speed
- Online login forms are far slower — but breaches happen
The fix that actually works
Any password found in breach data is burned forever — attackers try those first, everywhere. The durable fix is a password manager generating a unique random password per site, plus two-factor authentication on accounts that matter. Passwords leak through phishing too, so learn the patterns in modern scam techniques and how people actually lose accounts.