How does the password breach checker work?

Your browser hashes the password with SHA-1 locally, sends only the first five hex characters to the Have I Been Pwned Pwned Passwords range API, and compares the remaining hash suffixes locally. The plaintext password and full hash never leave your device.

Is my password sent to createpassword.in or HIBP in full?

No. createpassword.in does not receive or store the password. Have I Been Pwned receives only a five-character hash prefix (k-anonymity). Matching happens in your browser against returned suffixes.

What should I do if my password is found?

Stop using that password everywhere it was reused. Generate a unique replacement with our password or passphrase generator, store it in a password manager, and enable multi-factor authentication on important accounts.

Does “not found” mean my password is safe?

No. Absence from the queried corpus does not prove strength, uniqueness, or that the password was never exposed in an unpublished breach. Prefer long unique credentials and MFA regardless of the result.

Why SHA-1 for this check?

Pwned Passwords indexes SHA-1 hashes for range lookups. SHA-1 is used here only for compatibility with that public corpus, not as a password storage recommendation. Sites should store passwords with modern slow hashes such as Argon2 or bcrypt.

Can I check an email address here?

This tool checks passwords via the Pwned Passwords API. Full email breach search typically requires a different HIBP API and an API key; we intentionally only implement the privacy-preserving password range flow.

Password Breach Checker - Check if Your Password Was Hacked

What this tool does

The Password Breach Checker helps you learn whether a candidate password already appears in the Pwned Passwords corpus maintained by Have I Been Pwned. If it does, attackers who obtain breach dumps or use password dictionaries already know that string — so it is unsafe for any account.

How it works (k-anonymity)

You type a password into the field above (shown or hidden at your choice).
Your browser computes a SHA-1 hash of that password with the Web Crypto API.
Only the first five hexadecimal characters of that hash are requested from api.pwnedpasswords.com/range/….
HIBP returns many hash suffixes and occurrence counts for that prefix. Your browser compares the rest of your hash locally.
You see either a match count or “not found.” The plaintext password is never included in the request URL or body.

This design is documented by Troy Hunt / HIBP as a k-anonymity model: the service never receives enough of the hash to reverse a unique password from the query alone.

Privacy and data handling

createpassword.in does not store the password you enter for this check on our servers.
We do not log full hashes or plaintext passwords from this tool.
Network traffic for the check goes from your browser to Have I Been Pwned’s range endpoint (prefix only).
If you use browser extensions or corporate proxies, they may still observe outbound requests — use a trusted network when testing sensitive credentials.

Security considerations

Prefer checking candidate passwords you are about to set, or passwords you already plan to retire — not your only copy of a live master password on an untrusted device. After any positive match, rotate credentials and enable MFA. Align practice with NIST SP 800-63 guidance: long, unique secrets; screen against commonly used and compromised passwords; avoid arbitrary periodic resets when there is no evidence of compromise.

Practical use cases

Validate a new password from our password generator before saving it.
Screen a memorable passphrase against known dumps.
Double-check a password you reused historically before deciding whether rotation is urgent.
Combine with the strength checker for length and composition feedback (strength ≠ breach status).

Limitations

“Not found” is not a guarantee of safety or uniqueness.
The corpus covers known public dumps; private or very recent breaches may be missing.
SHA-1 is used only because the public Pwned Passwords index is SHA-1-based — not as a recommended storage algorithm for websites.
This page does not implement HIBP email/account breach search (that API differs and often requires a key).
Rate limits or network failures can block a check; use Retry when that happens.

Examples

Common passwords such as password or 123456 typically return very high occurrence counts. A long random string from a CSPRNG generator is far less likely to appear. Always treat any positive count as “do not use.”

Common mistakes

Assuming “not found” means the password is strong enough alone.
Reusing a “clean” password across many sites — breach status is only one risk factor.
Checking passwords on shared or public computers without clearing the field afterward.
Ignoring MFA after rotating a compromised password.

Password Breach Checker