Has your password been leaked?

How this checks your password without learning it

Typing a real password into a website is normally terrible advice, so it is worth explaining exactly why this case is different. The technique is called k-anonymity, and it works like this:

1. Your browser hashes the password with SHA-1, producing a 40-character fingerprint. Nothing has left your device yet.
2. Only the first five characters of that fingerprint are sent to the breach database — for example 5BAA6.
3. The database returns every hash beginning with those five characters, typically around 800 of them, with no idea which one you care about.
4. Your browser searches that list locally for the rest of your hash. The answer never travels anywhere.

The service therefore learns one of roughly 800 possibilities, which is no information at all. The request also carries an Add-Padding header, which pads the response with dummy records so that even the size of the reply gives nothing away.

What a match actually tells you

A match means this exact string of characters appears in breach data that has been made public. It does not mean your account was breached, and it does not mean somebody is targeting you. Most matches happen because a password is simply popular — the string password appears in the corpus over 52 million times, almost all of them belonging to other people.

The practical consequence is the same either way. Once a password is in the corpus, it is in the wordlists, and any attacker trying to break into an account will try it in the first fraction of a second. Popularity is what makes it dangerous, not who leaked it.

What a clean result does not tell you

This is where people misread the tool, so it is worth being blunt: not being breached is not the same as being strong. These two questions are completely independent.

The middle row is the trap. A clean breach result on a weak password creates false confidence. Run anything that passes this check through the pattern-aware strength checker as well — that one measures guessability rather than exposure.

What to do if your password was found

1. Do not edit it. Adding a digit, a symbol, or a capital to a breached password gains you almost nothing, because those are the default transformation rules in every cracking toolkit. Replace it outright.
2. Start with your email account. Email is the reset channel for everything else you own, which makes it the highest-value target and the first thing to fix.
3. Change it everywhere you reused it. This is the step people skip, and it is the one that matters most. A breached password is only dangerous because of credential stuffing — attackers replaying the same pair across hundreds of sites.
4. Turn on two-factor authentication where the account offers it. A correct password fails without the second factor, which buys you time even when a password does leak.
5. Stop the pattern from recurring. If you can remember a password, it is probably guessable, and if you reuse it, one breach becomes ten. Use a generator, or a system that recreates each password on demand so a different one exists for every site without you tracking any of them.

Why breach checking is not enough on its own

Checking against known breaches is reactive by definition: it can only tell you about leaks that have already happened and been published. Breaches often go undetected for months and unpublished for longer, so a clean result today says nothing about a dump sitting on a forum that nobody has processed yet.

The durable fix is structural rather than reactive. If every account has its own password, a breach anywhere costs you exactly one account and no others — and the question of whether any single password has leaked stops being frightening.