← All security tools

Password leak check

Check password

Local denylist first. HIBP is opt-in and sends only the first 5 hex chars of a SHA-1 hash.

Runs in your browser. Inputs stay on this device — nothing is uploaded to BrowserSpaces for processing.

Local list

Common passwords, offline.

HIBP optional

k-anonymity range API.

Clear disclosure

You choose before any network.

Use the tool

How it works

How leak checks work

Local mode compares against an embedded list. HIBP mode hashes with SHA-1, sends only the prefix to api.pwnedpasswords.com, and matches suffixes locally.

Before you start

  • Never paste production secrets into random sites — this one stays local unless you enable HIBP.

Three steps

  1. 1

    Enter password

    Not stored.

  2. 2

    Local check

    Instant denylist hit/miss.

  3. 3

    Optional HIBP

    Opt in for range lookup.