scan.now
Premium Scan a site

Check Whether a Password Has Been Leaked in a Data Breach

Checks a password against hundreds of millions of leaked credentials without ever sending the password itself, and measures its real strength with pattern, dictionary and entropy analysis.

Nothing is measured until you press the button. The password itself never leaves this page: The strength model runs in your browser, and the breach lookup sends only the first five characters of its SHA-1 hash. How k-anonymity works

Illustration of the password strength & breach checker in use

How it works

  1. Type or paste the password

    Nothing is measured while you type. The field is local to the page.

  2. Press Check this password

    The strength model runs in your browser and the breach lookup sends only the first five characters of a SHA-1 hash.

  3. Read the decomposition

    See which dictionary words, keyboard walks, repeats and dates an attacker would use, and how long each attack would take.

What this tool checks

3 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Password security

3 checks

The ones that most often decide the grade:

Critical Password found in a known data breachThis exact password appears in Have I Been Pwned's Pwned Passwords corpus of real breach data, so attackers already... High Password is weakThe password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words... Medium Password follows a predictable patternThe password follows a structure people use constantly, such as a word plus a year, a capital first letter with a...

After this one, most people run Phishing URL Checker. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

8 min read · Updated Sep 11, 2026 Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked

Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...

Read the guide 8 min read · Updated Sep 12, 2026 Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys

A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...

Read the guide 6 min read · Updated Sep 17, 2026 Are Browser Password Managers Safe? Built-In vs Dedicated Managers

Chrome, Firefox, Safari and Edge all store passwords, and they are safer than reuse. This guide compares built-in managers with...

Read the guide 8 min read · Updated Sep 14, 2026 Your Data Was in a Breach: What to Do in the First Hour, Day and Week

Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...

Read the guide

Frequently asked questions

Is my password sent to your server?

No. Your browser hashes it with SHA-1 and sends only the first five characters of the hash to look up a range of matching suffixes. The password never leaves your device.

What does 'seen 3,861,493 times' mean?

That exact password appears that many times in the Have I Been Pwned corpus of leaked credentials. Attackers try these first.

How is strength calculated?

Locally, in your browser, and only after you press the button. The model finds every dictionary word, name, keyboard walk, repeat, run and date inside the password, prices each one by how early a cracking rig would reach it, then searches for the cheapest way to assemble the whole string from those pieces. That guess count is what the crack times are derived from.

Why does it show how my password breaks apart?

Because the number on its own teaches nothing. Seeing that a password is 'one dictionary word plus a year' explains why adding another symbol will not help, and why a longer passphrase will.