Type or paste the password
Nothing is measured while you type. The field is local to the page.
Check Whether a Password Has Been Leaked in a Data Breach
Checks a password against hundreds of millions of leaked credentials without ever sending the password itself, and measures its real strength with pattern, dictionary and entropy analysis.
Nothing is measured until you press the button. The password itself never leaves this page: The strength model runs in your browser, and the breach lookup sends only the first five characters of its SHA-1 hash. How k-anonymity works
Analysing…
Free account
Keep seeing more results
Reveal larger scan previews, run more checks and keep server-generated reports for 30 days. Complete website reports remain Premium.
More resultsMore daily scans30-day history
How it works
Press Check this password
The strength model runs in your browser and the breach lookup sends only the first five characters of a SHA-1 hash.
Read the decomposition
See which dictionary words, keyboard walks, repeats and dates an attacker would use, and how long each attack would take.
What this tool checks
3 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
Password security
3 checksThe ones that most often decide the grade:
Critical
Password found in a known data breachThis exact password appears in Have I Been Pwned's Pwned Passwords corpus of real breach data, so attackers already...
High
Password is weakThe password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words...
Medium
Password follows a predictable patternThe password follows a structure people use constantly, such as a word plus a year, a capital first letter with a...
How password breach and strength checking stays private
Strength analysis runs locally, while the breach lookup uses a partial-hash range so the complete password and complete hash are never sent.
Password length is valuable, but real resistance also depends on predictability. Attackers try leaked passwords, common phrases, names, dates, keyboard walks and repeated patterns before brute-forcing random characters. A long familiar phrase can therefore be weaker than a shorter randomly generated value.
The page analyses patterns in your browser after you press the button. For the breach lookup, it hashes the password with SHA-1 and sends only the first five hexadecimal characters to the Have I Been Pwned range API. The browser receives a large matching range and compares the remaining hash locally, so Scan.now never receives the password or full hash.
Analyse locallyIdentify dictionary terms, repeats, dates and keyboard patterns in the browser.
Query a hash rangeSend only the first five SHA-1 characters for the breach check.
Explain the resultSeparate known breach reuse from estimated guessing resistance.
Put this result in context
This scanner answers one part of the review. Continue with Email Header Analyzer for sender, ip, route, spf, dkim and dmarc, then Phishing URL Checker for lookalike domains and hidden redirects. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked and Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys. The Password found in a known data breach check reference explains the exact test, evidence and remediation used in the report.
Password result components
Breach status and strength answer different questions, and either one can require a password change.
| Measure | What it asks | How to respond |
|---|---|---|
| Breach match | Has this exact password appeared in the public breach corpus? | Replace it everywhere it was used, regardless of its apparent complexity. |
| Pattern analysis | Can common words, dates, repeats or keyboard walks explain the password efficiently? | Use a generated password or unrelated random words instead of predictable transformations. |
| Guess estimate | How many attempts might common attack strategies need under stated assumptions? | Treat it as comparative guidance, not a promised number of years. |
| Length and composition | Does the value provide enough room for unpredictability? | Prefer length and randomness over forced symbol substitutions. |
| Reuse risk | Could one exposed password unlock several accounts? | Use a unique password for every service through a password manager. |
How to read a password check
A password can be unbreached and still predictable, or complex-looking and already widely known.
Unique and hard to guess
No breach match was found and the local model found no efficient common pattern. Store it in a password manager rather than memorising variants.
Found in breach data
Assume attackers include this exact value in credential-stuffing lists. Replace every reused copy immediately.
Predictable pattern
The password was not found in the corpus but common structure lowers its estimated resistance. Generate a less predictable replacement.
Build stronger account protection
- Generate a different random password for every account and keep it in a reputable password manager.
- Replace breached and reused passwords first, beginning with email, finance and administrator accounts.
- Enable phishing-resistant multi-factor authentication or passkeys where available.
- Change a password after evidence of compromise, not on a routine schedule that encourages weak variations.
What this result does not prove
- The breach corpus is extensive but cannot contain every private, recent or undisclosed compromise.
- Guess-time estimates depend on attack rate, hashing method and attacker knowledge, so they are not guarantees.
- This page cannot tell whether a password is reused elsewhere, stored safely by a service or protected by multi-factor authentication.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Email Header Analyzer
Sender, IP, route, SPF, DKIM and DMARC
Phishing URL Checker
Lookalike domains and hidden redirects
Browser Security & Privacy Check
Fingerprint, leaks, version, policies
File Malware Scanner
Malware in documents and archives
Guides for this tool
Background reading written to go with these results.
8 min read · Updated Sep 11, 2026
Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked
Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...
Read the guide
8 min read · Updated Sep 12, 2026
Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys
A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...
Read the guide
6 min read · Updated Sep 17, 2026
Are Browser Password Managers Safe? Built-In vs Dedicated Managers
Chrome, Firefox, Safari and Edge all store passwords, and they are safer than reuse. This guide compares built-in managers with...
Read the guide
8 min read · Updated Sep 14, 2026
Your Data Was in a Breach: What to Do in the First Hour, Day and Week
Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...
Read the guideFrequently asked questions
Is my password sent to your server?
No. Your browser hashes it with SHA-1 and sends only the first five characters of the hash to look up a range of matching suffixes. The password never leaves your device.
What does 'seen 3,861,493 times' mean?
That exact password appears that many times in the Have I Been Pwned corpus of leaked credentials. Attackers try these first.
How is strength calculated?
Locally, in your browser, and only after you press the button. The model finds every dictionary word, name, keyboard walk, repeat, run and date inside the password, prices each one by how early a cracking rig would reach it, then searches for the cheapest way to assemble the whole string from those pieces. That guess count is what the crack times are derived from.
Why does it show how my password breaks apart?
Because the number on its own teaches nothing. Seeing that a password is 'one dictionary word plus a year' explains why adding another symbol will not help, and why a longer passphrase will.
