In short. Breach-checking services answer whether a password has appeared in a known dump, and the reputable ones do it without receiving the password: your client sends a partial hash and matches the rest locally. A service that asks for the plaintext is the thing you are protecting against.
A leaked password is more dangerous than a weak one. A weak password still has to be guessed; a leaked one is already on a list and gets replayed automatically across hundreds of sites. Checking whether yours appears in known breaches takes a second — and, importantly, without handing the password to anyone. Here is how that works, why it is safe, and what to do with the answer.
Credential stuffing, and why it is the main threat
When a service is breached, email-and-password pairs escape. What follows is not what most people picture: nobody attacks that same service. The list is taken and replayed automatically against dozens of others — email, marketplaces, banks, social networks.
The technique is called credential stuffing and it works for one reason: people reuse passwords. A forum breach from five years ago becomes access to your email if the password there was the same.
Password strength does not help here at all. A twenty-character random password that appears in a breach falls as instantly as 12345 — it is already known, there is nothing to guess.
How to check without handing it over
- Your device computes the SHA-1 hash of the password, producing something like
5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8. - Only the first five characters are sent:
5BAA6. - The service returns every hash it knows beginning with those five — usually 400 to 900 of them.
- The match is found on your device, within that returned list.
The service never learns which password you checked: five hash characters correspond to hundreds of different passwords, and the original cannot be recovered from them. Nor does it learn whether a match was found — the search did not happen there.
Where to check
The principal source is Have I Been Pwned, an aggregator of known public breaches run by security researcher Troy Hunt, who also devised the k-anonymity scheme. It holds over 800 million unique passwords from real incidents.
You can check against it directly in the password generator: type the password into the check field and press the breach lookup. The hash is computed in the browser, five characters leave, and the password itself never leaves the device.
If the password is found
- Change it immediately everywhere it was used — starting with email, not "at some point".
- Recall where else it was. Reuse is what turns one breach into a chain. A password manager flags repeats itself.
- Turn on a second factor at least for email and banking: it protects even when the password is already known.
- Check active sessions — most services let you end every other login.
- Generate the replacement, do not invent it. An invented replacement is usually a variation of the old one.
What "not found" means
Only this: the password is not in known public breaches today. That is not a guarantee. A breach may be unpublished, may not have reached the aggregator, or may happen tomorrow.
Breach checking is therefore not a substitute for hygiene but an addition to it. A unique random password per service protects even against the breach nobody knows about yet.
Checking an address is not the same as checking a password
| What is checked | What you learn | What to do |
|---|---|---|
| Password | whether it has appeared in breaches | change it if so |
| Email address | which incidents the address appeared in | change those services' passwords |
Frequently asked questions
Is it safe to type a password into a checking form?
It depends on how the check works. If the service sends the password to a server, no. If the hash is computed in the browser and only the first five characters are transmitted, yes — they cannot reconstruct the password and cannot tell which of hundreds of candidates you checked.
Why SHA-1, which is obsolete?
Here it serves as a stable identifier for matching rather than as protection. Its weakness to collisions does not bear on this task: ready-made hashes are compared, nothing is being authenticated.
My password was found a million times — what does that mean?
That it appeared in breaches a million times, which puts it at the front of every cracking list. Such a password falls on the first attempt regardless of length or character set.
Should passwords be checked regularly?
It is sensible to check on change and after news of a breach at a service you use. There is no calendar requirement — much like scheduled password rotation.
In short
- A leaked password is worse than a weak one: it is not guessed, it is already known.
- A k-anonymity check transmits five hash characters — the password never leaves the device.
- Found means change it now, everywhere it was reused, and turn on a second factor.
- "Not found" only means "not published yet"; a unique password protects against unknown breaches too.