Hashfirst

Check a password against known breaches without sending it anywhere.

Breaches tracked
—
Accounts exposed
—
Most recent
—

Check a password

Hashed in this browser. Five characters are transmitted; the password itself is not.

Nothing is sent until you press Check.

Example — what leaves the browser
CBFDAC6008F9CAB4083784CBD1874F76618D2A97
First 5 characters — sent Remaining 35 — never sent

The SHA-1 of “password123”. Those five characters match roughly 2,000 other hashes, which is what keeps the lookup anonymous.

Why this is safe to use

  1. Your password is SHA-1 hashed inside this browser tab.
  2. Only the first five characters of that hash are sent to api.pwnedpasswords.com.
  3. The API returns every hash beginning with those five characters — typically a few hundred.
  4. Your hash is matched against that list locally, so the answer never leaves your machine.

This is the k-anonymity model, the scheme Have I Been Pwned documents for exactly this purpose. The service cannot determine which password you checked. Requests also ask for padding, so the size of the response reveals nothing either.

Email search is not offered here. That endpoint requires a paid API key and would mean transmitting your address to a server. Search it free at haveibeenpwned.com.

Breach directory

Loading directory…