/Pwned Password Checker
Check if a password has been exposed in data breaches. This tool uses the Have I Been Pwned API via the K-Anonymity model, meaning your actual password never leaves your browser.
External API
On request, sends the first five characters of a SHA-1 password hash to the HIBP API. The password itself is not sent.
Command Palette
Search for a command to run...
Test a Password
Type a password below to check its breach status safely.
Is this safe?
Yes. This tool uses the K-Anonymity model.
When you type a password, your browser creates a SHA-1 hash of it. It only sends the first 5 characters of that hash to the server.
The API returns hundreds of suffixes that match those 5 characters. Your browser then checks the list locally. Your actual password (and even its full hash) is never transmitted.
Related Tools
Incident Response Playbook Engine
Design and execute structured security incident response workflows.
MITRE ATT&CK Reference
Search and reference common MITRE ATT&CK tactics, techniques, and procedures (TTPs).
Windows Events Reference
Search and reference Windows Security and Sysmon Event IDs.
Linux Telemetry Reference
Search and reference Linux Logs and Auditd Records.