How to Check If Your Password Has Been Leaked

You can find out if a password has appeared in a data breach without telling anyone what it is. Here is how, and what to do with the answer.

By Siddharth ShankarUpdated October 21, 2026

If a password appears in a breach, criminals add it to lists and try it on other accounts. Checking is a good habit, as long as you do it in a safe way.

Two different questions

• Has my email been in a breach? This tells you which services lost data. Use our free email check.
• Has this password appeared in a breach? This tells you if the password itself is known to criminals.

How a safe password check works

A technical write-up of the Have I Been Pwned range check explains the method, called k-anonymity:

• Only the first five hex characters of the password’s SHA-1 hash are sent.
• The service returns every breached hash ending that shares that prefix, each with a breach count, usually around 800 to 1,000 candidates.
• Your device searches that list locally for the matching ending.

Because the server gets only a short prefix and returns many candidates, it never learns which password you checked. The write-up adds that response padding can hide response sizes from someone watching traffic.

What the result means

• Found, with a high count: the password is well known. Stop using it everywhere.
• Found, with a low count: it has appeared in at least one breach. Change it.
• Not found: it has not appeared in known breaches. That does not make it strong. A short or guessable password can be cracked without ever being leaked.

Be careful where you check

The write-up notes that k-anonymity protects you from the checking service, but not from a backend that you route the request through. Use a trusted tool, or a password manager that has the check built in, and never type your password into a site you do not trust.

What to do if a password is found

Build a habit

Many password managers run this check for you and flag reused or breached passwords. Open the report every few months, fix the red items first and let the manager generate replacements. The goal is not to memorise anything, only to make sure no two accounts share a password.

Why length beats cleverness

Attackers guess common patterns first, such as a name with a year or a word with a number on the end. A long random password or a passphrase of several unrelated words takes far longer to crack. If you must remember one password, make it the one for your password manager, and make it long.

If you reuse a password you cannot change

Some old accounts are hard to update. Close the accounts you no longer use, and for the ones you keep, make sure the password is unique and that two-step verification is on. Do not leave a leaked password protecting anything important.

Related reading

See stolen password and credential statistics, what a combolist is and what to do when your email is in a data breach.