Breach CheckHow secure is your password?
Find out how quickly it could be cracked and whether it has already appeared in data breaches. Your password never leaves your device.
- Free
- No sign-up
- Stays on your device
Check password
We store nothing. Your password is never transmitted – not even to us.
Data on leaked passwords: Pwned Passwords by Have I Been Pwned. No guarantee of accuracy.
How your password stays secret
- Strength right in your browserThe rating runs entirely on your device, using lists of common passwords, words and names.
- Only a fragment leaves your deviceYour browser creates a fingerprint (SHA-1 hash) of the password. Only its first 5 of 40 characters go via our server to the Pwned Passwords database.
- The comparison happens on your sideHundreds of fingerprints with the same first characters come back. Your browser checks whether yours is among them. Nobody but you learns the result.
What a strong password looks like
Length beats special characters. Long, random passwords that you use nowhere else are the safest.
- At least 12 charactersEvery extra character multiplies the time an attacker needs to try all combinations.
- Passphrase instead of a made-up wordFour or more random words are easy to remember and hard to guess – better than “Summer2024!”.
- A separate one for every accountWhen a service is hacked, attackers automatically try the password on other services.
- Password manager and two-factorA password manager creates and remembers strong passwords. Two-factor authentication protects you if one is stolen anyway.
Frequently asked questions
Is it safe to enter my real password here?
Yes. Your password is neither stored nor transmitted. Only the first 5 characters of its SHA-1 fingerprint leave your device – the password cannot be calculated back from them. If you want to be completely sure, check a password you are going to change anyway.
What does the estimated time to crack mean?
It shows how long an attacker would need to try out a stolen, well-protected password database. The estimate is a guideline, not a guarantee.
Where does the data on leaked passwords come from?
From Pwned Passwords by Have I Been Pwned. The collection contains passwords from data breaches that have become public.
What should I do if my password was found?
Stop using it and change it wherever you use it. Turn on two-factor authentication wherever possible.
What about your email address?
Also check whether your address appears in known data breaches.
Check email address