UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free breached password checker does
Every year billions of passwords leak from hacked websites. Attackers collect them into huge lists and try them against other services, because many people reuse passwords. This free online breached password checker tells you whether a password you use has appeared in one of those known leaks, and how often, so you can replace it before someone tries it on your accounts.
The key point is privacy. A tool that asked you to send your password to a server would defeat the purpose. This one uses a method called k-anonymity. Your browser creates a SHA-1 hash of the password, sends only the first five characters of it, and then searches the returned list for the rest locally. The service never learns your password or even your full hash.
How to use the breached password checker
- Pick what to check. One password, several passwords or a SHA-1 hash.
- Enter it and press Check. The tool shows the five characters that leave your browser and the part that stays.
- Read the result. You see whether it was found and how many times.
- Act on it. If found, change it. If not found, still make sure it is long, unique and random.
For an important account, test a similar password instead of the real one, or hash the password yourself and use the hash option.
How the private lookup works
A SHA-1 hash of the word password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. The tool sends only 5BAA6 and receives every known hash that starts with those five characters, usually several hundred, each with a count. Your browser then checks locally whether the rest of your hash, 1E4C9B93F3F0682250B6CF8331B7EE68FD8, is in that list. Because hundreds of hashes share the prefix, the service cannot tell which one you were looking for. Your password and your full hash never leave the page, and the request is sent without cookies or a referrer.
Understanding the result
| Result | Meaning | What to do |
|---|---|---|
| Not found | Not in the known breach list | Still use a long, unique password |
| Found a few times | Appeared in at least one leak | Change it everywhere it is used |
| Found thousands or millions of times | A very common password | Stop using it at once |
A found password is not necessarily yours that leaked. Many people choose the same simple password, so a common password shows up even if your own accounts were never hacked. The risk is the same: attackers try it first.
What to do if your password was found
- Change it on every account that used it, starting with email, banking and work accounts.
- Create a unique password for each account, ideally with a password manager.
- Turn on two-factor authentication.
- Check your account activity and recovery details for anything unusual.
- Do not make small changes to the old password. Attackers try those too.
Use the Password Strength Checker on this site to test the new password and the Passphrase Generator to create one that is easy to remember.
Why password reuse is so dangerous
When a site is breached, the stolen passwords are tested automatically on other services such as email, shopping and banking. This is called credential stuffing, and it works because many people reuse one password in many places. A single leaked password can open several accounts. A unique password per account limits the damage to the one site that was breached.
What this tool cannot tell you
- It cannot tell whether your email address or accounts were breached.
- It cannot see leaks that are not in the public list.
- It does not judge strength. A random password that was never leaked is found zero times, and so is a weak but unusual one.
- It cannot tell you which site leaked the password.
How passwords leak and what happens next
Passwords leak in several ways. A website may be hacked and its database copied. Malware on a device may record what you type. A fake login page may collect passwords from careless visitors. Once a list of passwords is stolen, criminals sell and share it. Automated tools then try each email and password pair on many popular sites, which is called credential stuffing. A leaked password that you reuse can therefore turn a small breach at an unimportant site into the loss of an important account. Checking a password against a breach list lets you break that chain before it is used.
Good habits after a breach check
- Use a password manager to create a different random password for each account.
- Change the password for your email first, then banking and shopping.
- Turn on two-factor authentication everywhere it is offered.
- Use the email breach notification feature of the service you trust, to learn when your address appears in new leaks.
- Be careful of emails that claim a breach and ask you to log in through a link. Go to the website directly instead.
- Run the check again when you create a new password, and especially for a password that you made yourself.
Privacy, limits and responsible use
The request goes from your browser straight to the Pwned Passwords service. It carries only the five-character prefix, with no cookies and no referrer. Utiliby does not receive the password, the hash or the result. The data comes from the Have I Been Pwned project, which is a separate service with its own terms, and this tool is not affiliated with it. Use it for your own passwords only.
Frequently asked questions
How do I check if my password was in a data breach?
Enter it in the box and press Check for breaches. The tool tells you whether it appears in a large list of passwords from known breaches, and how many times.
Is it safe to type my password here?
Your browser hashes it and sends only the first 5 characters of the hash. The service cannot tell which password you checked. Still, for important accounts, test a similar password or use the hash option.
What data does the service receive?
Only a 5-character prefix of a SHA-1 hash, such as 5BAA6. Many thousands of different passwords share each prefix.
What does it mean if my password is found?
It has appeared in at least one breach and is on lists that attackers use. Stop using it and change it everywhere you used it.
What if the password is not found?
That is good news, but it is not a guarantee. The list covers known breaches only, and a weak password that was never leaked can still be guessed.
Why does the tool show a number?
It is the number of times that password appeared in the data. A large number means the password is very common, such as a word, name or simple pattern.
Does this tell me if my email was breached?
No. This tool checks passwords only. It does not take or check email addresses.
Can I check many passwords at once?
Yes. Use Several passwords, with one on each line, up to 25. The report hides the passwords.
What is the SHA-1 hash option?
If you already have the hash, you can paste it and the tool sends only its first 5 characters. You never type the password at all.
Why is SHA-1 used?
The breach list is indexed by SHA-1 hashes, so the lookup must use the same. It is used for matching only, not for security.
Which service provides the data?
The public Pwned Passwords service run by Have I Been Pwned. This tool is independent and not affiliated with it.
Why did the check fail?
The service may be blocked by an ad blocker, a firewall, or no connection. Allow api.pwnedpasswords.com and try again.
Is a found password safe if I add a number?
No. Attackers try common changes too, such as adding 1 or an exclamation mark. Choose a new, unrelated password.
What should I do next?
Change the password, use a unique one for each site, store them in a password manager and turn on two-factor authentication.
Does Utiliby store my password?
No. It never receives the password or its hash. Your browser contacts the breach service directly.
What does the report include?
Whether each item was found and how often. It never includes the password or the hash.
Is it free?
Yes. It is free to use online with no sign-up.
Sources and further reading
- Have I Been Pwned, Pwned Passwords API v3 and k-anonymity model (haveibeenpwned.com).
- Cloudflare blog, Validating leaked passwords with k-anonymity.
- NIST SP 800-63B, Digital Identity Guidelines, on checking passwords against breach lists (nist.gov).
- OWASP Credential Stuffing Prevention Cheat Sheet (owasp.org).
- UK National Cyber Security Centre, Password guidance (ncsc.gov.uk).
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.