The fix, in one snippet
Attackers take leaked email + password pairs and try them
on every other site. Reuse is what makes that work.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The password is hashed with SHA-1 in your browser. Only the first five hexadecimal characters of that hash are sent to the Pwned Passwords range endpoint (https://api.pwnedpasswords.com/range/XXXXX), which returns every known hash suffix beginning with that prefix (several hundred per prefix, with the Add-Padding header making responses uniform in size). The comparison against the full hash happens locally, and the report shows how many times the password has appeared in breaches. The password itself never leaves your browser and is never seen or stored by Scan.now; whether the range request is made from the browser or relayed through our server, only the five-character prefix is transmitted. Limits: absence from the corpus does not mean the password was never breached, only that it is not in this dataset; a count of one is as bad as a count of a million, because cracking lists include both.
Why it matters
Credential stuffing replays leaked email and password pairs against every major site at scale, and password spraying tries the most common leaked passwords against many accounts. Both succeed only because passwords are reused. NIST SP 800-63B requires verifiers to compare new passwords against breach corpora for this reason. If you use this password anywhere else, those accounts are exposed now, regardless of how strong the password looks.
How to fix it
Change it everywhere it is used, starting with your email account (the recovery point for everything else) and financial services. Do not modify it by appending a digit or a symbol; cracking rules try those first. Generate a unique replacement per site with a password manager, enable two-factor authentication, prefer passkeys where offered, and sign out other sessions. If the breached password protected an email account, check for forwarding rules and recovery addresses you did not add. Related: weak passwords. Guides: password security, responding to a breach, two-factor authentication and browser password managers.
Where this fits
Password found in a known data breach is check 1 of 3 that the password strength & breach checker runs under password security, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
What fixing this still leaves open
Password found in a known data breach closes one route in. Immediately below it: Password is weak, where the password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words with predictable changes; Password follows a predictable pattern, where the password follows a structure people use constantly, such as a word plus a year, a capital first letter with a symbol at the end, or a keyboard walk, which cracking rules try first.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Password found in a known data breach (critical severity)
Scanner check id: password-breachedThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 11, 2026
Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked
Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...
Read the guide
8 min read · Updated Sep 14, 2026
Your Data Was in a Breach: What to Do in the First Hour, Day and Week
Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...
Read the guide
8 min read · Updated Sep 12, 2026
Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys
A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...
Read the guide